Hands-On Artificial Intelligence for Cybersecurity

Incident response and threat mitigation

Obviously, the implementation of an anomaly detection system assumes that the alerts generated are properly managed.

With incident response, we indicate the set of activities carried out after alerts are delivered.

These activities are usually managed by human operators who are specialized in the various sectors of competence, engaged in investigating and deepening the evidence associated with alerts.

Given the high level of specialization required to carry out such investigations (just think, for example, of digital forensics activities that originate from the reporting of a data breach), the adoption of automated procedures are usually limited to supporting human operators in their specialized activities, ...