# Internal Activities An **activity** is a record of work: something that needs to be done, something that was done, how a problem was solved. Activities live in the **Activities** tab of the [Workspace](https://wiki.cyberguard.srl/cat/workspace.md). ## Recording an Activity  Click **New activity** in the Workspace, use the Workspace button at the bottom right of any page, or start from a finding, an object, an incident or a MITRE technique with **Document in the workspace** / **Add activity**: in that case the activity is linked to that item automatically. | Field | What to enter | | --- | --- | | **Scope** | The area the activity belongs to: Active Directory, Microsoft Entra, Microsoft 365, Microsoft Defender XDR, Compliance or Networking. | | **Assigned to** | Who is in charge of it. Leave it unassigned if it is just a note. | | **Description** | What needs to be done, what was done, how it was resolved. You can format the text: `**bold**`, `` `code` ``, ```` ``` ```` for a block of code (useful for commands and queries), `-` for a list. | | **Status** | **Open** while the work is in progress, **Resolved** when it is done. | The activity records the author and the date automatically. ## Finding and Following Activities The **Activities** tab lists all activities with the last update, scope, description, owner, author and status. Filter them by: - **Scope** — for example only Active Directory; - **Assigned to** — **Assigned to me**, unassigned, or a specific person; - **Status** — open, resolved or all; - **Search** — text, item or author. Open an activity to edit it, mark it as resolved or reopen it. When you open a finding or an incident that already has activities, you see their history: what was done before, by whom and when. ## Good Practices - Record the decision as well as the action: why a finding was left open, why a risk was [accepted](https://wiki.cyberguard.srl/cat/assessment/security-score.md#accepting-a-risk), what compensating control is in place. - Assign each open activity to someone, and resolve it as soon as the work is done: idle activities show up in the Dashboard and in the weekly summary. - After a remediation, run a new assessment and check the result in [What changed](https://wiki.cyberguard.srl/cat/assessment/security-score/what-changed.md), then resolve the activity.