Key Case Management Concepts

Alerts - Incidents generated by 3rd party security systems or through custom detection workflows.

Observables - field of interest extracted from incoming alerts. Examples include IP address, file hash, DNS, or User, Email, etc. Observables are used to identify and correlate multiple alerts as well as measure the risk of the alert.

Cases - A collection of related alerts that are grouped together for investigation and response. Cases help analysts track and manage security incidents more efficiently.

Alert Ingestion - The process of receiving/ingesting alerts from 3rd party sources.

Alert Processing - The process of extracting data such as name, severity and observables from ingested alerts and either creating a new case for the alert or appending the alert to an already existing case.

Enrichment- The process of enriching observables with additional information from 3rd party sources. This may either be threat intelligence to score the risk of the observable (e.g. DNS www.evilabc.com is Malicious), or may be simple enrichment such as providing additional information on the observable (e.g. User ‘John Smith’ works at R&D and reports to ‘Bob Shnider’)

Response- The process of investigating and taking action with regards to the case. This can either be automated or manual. For example, isolating an infected device or automatically closing the case because it’s a ‘False Positive’