Once again, to wrap up this set of videos regarding incident management and
instance on the 40 analyzer,
I'd like to pose this customer scenario and here it is. The customer has the
following questions
regarding the differences between events and incidents on the 40 analyzer. So
my question for
you is before we chat with this customer, how would you explain the differences
to that customer
between incidents and events? So take a moment right now, think about how we
should respond to
that customer. And then when you're ready, click on resume and we'll take a WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
that customer. And then when you're ready, click on resume and we'll take a
look at this question
together. All right, so before we go chat with the customer, we probably just
want to confirm
just you and I that we understand a couple pieces. Number one, devices, fordnet
devices,
include fordigates, are sending log information over to the 40 analyzer that 40
analyzer puts
them into SQL database. And when it does so, we can start using features like
fordive you and also
simultaneously, the 40 analyzer is using event handlers to create events based WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
simultaneously, the 40 analyzer is using event handlers to create events based
on the rules in
those event handlers. So for the first part regarding events is the 40 analyzer
event handlers
that are looking at all that log information coming in and then based on
conditions based on
set of rules, creating the events. So think of events like little notifications
, events inside
of 40 analyzer stating what happened and they're created by the event handlers.
However, if we want
to do something about those events that are happening, we'd want to make sure
we have some kind of a
ticketing system so that we can, you know, you know, start focusing as a team WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
ticketing system so that we can, you know, you know, start focusing as a team
on what's going on
and do further analysis. And that's when we take one or more events and we
include them as part
of an incident. And for the customer, I'd probably tell them that the incident
is really more like
a ticket, meaning a ticket identifying that there's some issue or question or
problem. And then we
can do our threat hunting and searching and updating of that ticket, aka the
incident, to work it all
the way through to completion. Now as part of that, we can also leverage the
MITRE ATT&CK framework, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
MITRE ATT&CK framework,
which is built into the 40 analyzer with the right licensing, which can help
give us additional
insight because if we have an incident that's automatically created by an event
handler and it
includes the MITRE ATT&CK framework information, that's more information that
we can use to research
about what's happening on our network that we can include as part of that
incident. So again,
as a summary for our customer, events are based on rules that are set up
regarding what's happened
across our network devices and our fordnet devices that are reporting in. And
the incident is like WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
the incident is like
the ticketing service or the method that we can track an investigation or
analysis where we can
collaborate as a security team to help work all the way through to identify
what it is. Is it a
false positive? Is it super critical? Or do we need to change some policies on
some of our firewalls?
So thanks for joining me in this set of videos for getting incident management
and I'd like
forward to seeing you my friend in another set of videos very, very soon. Until
then,
I hope this has been informative and I'd like to thank you for viewing.