Mini-Module
Summary
The Incident Management 101 module provides structured coverage of essential concepts and techniques in Incident Management 101. The module covers topics including Basic Definitions About Incident Management, CaseAlert Naming, Incident Management Systems (IMS), Introduction to Incident Management, Playbooks, and more.
Recommended prior knowledge:
- General understanding of cybersecurity concepts
Introduction to Incident Management
In this module; we will talk about how an incident that occurred within the organization is handled and how the investigation process should be carried out. While doing this, we will give examples from LetsDefend from time to time, and sometimes we will talk about the best practices.
The National Cyber Security Centre (NCSC) defines a cyber incident as a breach of a system's security policy in order to affect its integrity or availability and/or the unauthorized access or attempted access to a system or systems; in line with the Computer Misuse Act.
In our previous SIEM 101 training, we talked about how data is collected and converted into alerts within the SOC. If you have not completed that training yet, we recommend that you complete it by clicking the link and then continue from here. One of the platforms where alerts on SIEM are collected and investigated is the “Incident Management System”.
In the continuation of this training, we will explain how an Incident Management System works, and why and how to use these systems as SOC analysts.