Incident Response

If We Ruled the World

We have described a large collection of different tools that are available to the incident response practitioner. In most cases, there were numerous tools per category. We did that not out of some sense of fairness to the tool vendors, but because no single tool has successfully solved all of our needs over time. In fact, we’ve found it highly advantageous to keep a large collection of tools available because each new incident situation requires a new solution set. Subtle differences among incidents can require completely different tools.

So, we got to thinking about what would make up the perfect tool collection. Perhaps that isn’t a goal that can be accomplished, but some of the criteria that we’d look for in our perfect tools would include the following list:

Analysis support

Although not a specific design goal for many of the general-purpose tools that we’ve discussed, robust support for the analysis and documentation process is very weak among the currently available tools. For the analysis capabilities to be truly useful in incident response would mean that the tools need to do accurate visualization of the attacks, have indexed notes that the analyst can tag to the data to quickly document certain aspects of the attack (almost like electronic Post-it® notes), and the ability to quickly view, fast forward, rewind, search, etc., the collected data. Since the tools that we’ve described were not designed specifically for incident response, they fall short ...