In this video, we're going to take a big picture look at the wonderful world of
incident management overview. And as I mentioned in the intro, incident, think
of it like a service
request or a ticket or an entity here on the 40 analyzer that we can use to
input information
into and track until it's completed. And most of the time in a security
environment,
it's going to be security related elements and events that are going to go into
an incident.
Let's also imagine that our 40 analyzer has received log information from WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Let's also imagine that our 40 analyzer has received log information from
various devices,
including our 40 gates. And we have some event handlers that have created
events for us. Now,
as part of the event handlers that are creating the events, we could as part of
those event handlers
also have them automatically take the next step and then as to go ahead and
create an incident.
And again, think of an incident like a ticket or a service request that's
identifying something
that needs to be further investigated. So this incident in this overview is
chat about how it
can be created. One way is we could have it created from the event handler that
automatically creates
it for us or the other option is we can do it manually. And when we do it WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
it for us or the other option is we can do it manually. And when we do it
manually, sometimes
it's referred to in the documentation as raising an incident. So we think of
that like, let's imagine
we're looking at our events, we could right click and say from the dropdown, I
want to create a new
incident. That'd be an example of raising or we could go to the window for
incidents and simply
click on create new. So if you ever see the concept of raising an incident,
think of it like we're
creating an incident. So in this set of videos, we're going to take a look at
the creation of an
incident and how to manage those incidents, as well as how to do analysis of WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
incident and how to manage those incidents, as well as how to do analysis of
those incidents,
and then also take a look at reporting, including creating a report based on
the instance, or
we could also take reports that we generate and include them as details that
can be associated
with that incident. So that's the big picture regarding incidents and the
probably the best way
understanding it is to see it in action. And we'll begin that process in the
very next video. So
I'll see you there in just a moment.