Hands-On Security in DevOps

Security incident response platforms (SIRP)

When handling a security incident, there will be lots of information that needs to be processed and analyzed. An ideal security incident response platform should be able to do the following:

• Receive alerts and security events from different sources (SIEM, IDS, email)
• The security incident case management should allow a security analyst to add related logs, IOCs, or findings during the incident case handling life cycle
• Compare its analysis with external threat information, such as VirusTotal, to identify the malicious behaviors of a file, hash, domain, or IP address

The open source tool TheHive can help you to provide a security incident response management platform. TheHive can also work with ...