2
A Deep Dive into Incident Management and Investigation
The previous chapter touched on the importance of cybersecurity today and why investing in modern security tools and education is essential. We also covered the main pain points of SOCs today, such as the never-ending growth of security incidents and security-related logs, the number of tools, and staying arm-to-arm with bad actors.
As established, the SOAR solution consists of a few different elements, such as incident management, investigation, automation, reporting, threat intelligence (TI), and threat and vulnerability management (TVM). Each of these plays an important part in a SOC and makes SOCs more efficient and effective. This is critical today since SOCs are overloaded with security ...
Get Security Orchestration, Automation, and Response for Security Analysts now with the O’Reilly learning platform.
O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.
