Computer Incident Response and Forensics Team Management

Section 2

Definitions

This section provides definitions and descriptions of the various terms, jobs, roles and responsibilities, and positions within the response and forensics teams.

Keywords

Incident; event; response; forensics

This section provides definitions and descriptions of the various terms, jobs, roles and responsibilities, and positions within the response and forensics teams.

First, we will list a couple of primary definitions, and then the definitions in alphabetical order:

Event: An “event” is any observable occurrence in a system and/or network. An event can indicate that an incident is occurring. Examples include:

■ Entries in system boot logs (eventlog/syslog)

■ System crash

■ Network performance slowdown

■ 500 new e-mail messages in ...