Life Cycle of Incident Management

INCIDENT MANAGEMENT
Security incident management is the process of identifying, managing, recording and

analysing security threats or incidents in real-time. It seeks to give a robust and
comprehensive view of any security issues within an IT infrastructure.
A security incident can be anything from an active threat to an attempted intrusion to a

successful compromise or data breach. Policy violations and unauthorized access to data such
as health, financial, social security numbers, and personally identifiable records are all
examples of security incidents.
Life Cycle of Incident Management
1. Incident Identification and Logging

Incident Identification is either done via testing (using tools or otherwise), user feedback,
infrastructure monitoring, etc.
Logging an incident simply means recording the following info:
• Exact/Appropriate date and time of occurrence.
• Incident title along with type and brief description
• Name of the person who logged the incident and more detailed description
with error codes when applicable
• Details of the person assigned to the incident for follow up
• Current Status of the incident
• Attachments including technical discussions, decisions and approvals.
2. Classification and Prioritization
Classification of incidents helps us partition them based on their type (software, hardware,
service request, etc.) so it makes for easier reporting and analysis. Prioritization helps to
identify the order/priority of incidents to be handled. It depends on the impact, severity and
most importantly the Risk Factor.
3. Investigation and Analysis

This step is to better understand the problem so we not only fix it right now, but gather
information for preventing from re-occurrence.
4. Resolution and Recovery

Steps are taken to remove the incident and bring the system back to its previous working
condition.
5. Incident Closure
The resolution is retested and in case the system is working as intended, the incident is
closed.
Top Incident Tracking Tools

1. ManageEngine
The ManageEngine Event Log Analyzer is a SIEM tool that focuses on analysing the various
logs and extracts various performance and security information from them. The tool, which
is ideally a log server, has analytical functions that can identify and report unusual trends in
the logs, such as those resulting from unauthorized access to the organization’s IT systems
and assets
2. IBM QRadar
IBM QRadar SIEM is a great detection tool that enables security teams to understand the
threats and prioritize the responses. The Qradar takes the asset, user, network, cloud, and
endpoint data, then correlates it against the threat intelligence and vulnerability information.
After this, it applies advanced analytics to detect and track threats as they penetrate and
propagate through the systems.
3. SolarWinds
SolarWinds has extensive log management and reporting abilities, real-time incident
response. It can analyse and identify exploits and threats in areas such as the Windows event
logs hence allows the teams to monitor and address the systems against threats.
Security Event Manager has simple to use visualization tools that allow users to easily identify
suspicious activities or anomalies. It also has a detailed and easy to use the dashboard in
addition to great support from the developers.
4. Sumo Logic
Sumo Logic is a flexible cloud-based intelligent security analytics platform that works on its
own or alongside other SIEM solutions on multi-cloud as well as hybrid environments.
The platform uses machine learning for enhanced threat detection and investigations and can
detect and respond to a wide range of security issues in real-time. Based on a unified data
model, Sumo Logic allows security teams to consolidate security analytics, log management,
and compliance and other solutions into one. The solution improves the incidence response
processes in addition to automating various security tasks. It is also easy to deploy, use, and
scale without costly hardware and software upgrades.
5. AlientVault
AlientVault USM is a comprehensive tool combining threat detection, incident response, as

well as the compliance management to provide comprehensive security monitoring and
remediation for on-premise and cloud environments. The tool has multiple security
capabilities that also include intrusion detection, vulnerability assessment, asset discovery and
inventory, log management, event correlation, email alerts, compliance checks, etc.

Life Cycle of Incident Management

Uploaded by

Copyright:

Available Formats

Life Cycle of Incident Management

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Life Cycle of Incident Management

Uploaded by

Copyright:

Available Formats

INCIDENT MANAGEMENT

Security incident management is the process of identifying, managing, recording and

A security incident can be anything from an active threat to an attempted intrusion to a

Life Cycle of Incident Management

1. Incident Identification and Logging

3. Investigation and Analysis

4. Resolution and Recovery

Top Incident Tracking Tools

AlientVault USM is a comprehensive tool combining threat detection, incident response, as

You might also like