-
Book Overview & Buying
-
Table Of Contents
Security Orchestration, Automation, and Response for Security Analysts
By :
Incident management is the process we go through from incident detection to the time the incident is resolved. In SOC, this is where SOC analysts will be able to monitor incidents as they are created, filter incidents based on conditions, search through the incidents, and perform fast incident actions.
Without incident management, our SOC analysts wouldn’t be able to see what incidents were created and from where they would need to start the incident investigation.
The primary purpose of incident management is to do the following:
The main purpose of SOAR is to make the daily tasks of a SOC easier to handle. Let’s see how SOAR accomplishes this purpose.
Imagine that the SOC team doesn’t have an incident management solution. An incident is detected...