Incident management
From xDR to case management
RedCarbon Platform introduces a specific flow methodology
This permits very effective management of an incident and its elevation to become a Case.
A single alert extracted from an xDR feed or Log system is initially just an event. In RedCarbon’s vision and philosophy, it became a Case only after the Virtual Analyst had ingested it and had started its Cyber Analysis job producing a report with all its collateral, Notes, Observable and IOC.
According to the user login, the platform is aware of user permission and customer assigned to him, to a specific reseller or a System Integrator.
Assignment of a Case
Based on their given permission, every user has specific rights to manage a Case. The Incident Management console permits users to assign themselves a particular Case.
Closing or escalation of a Case
Once assigned, the Case could be closed if the Virtual Assistant analysis is considered adequate. Where a Virtual Assistant finds a doubt situation or the human operator has doubt too, it could be escalated to a higher tier of intervention to a more expert operator.
Case Searching for details
Cases shown in the console could be searched by their status and classification, making it easier for operators to focus on the more important ones.
Volume management
In some applicative customer cases (e.g. a legitimate weekly scan or a considerable attack), operators may be overcome by a massive volume of warnings. In this case, the platform permits grouping the ones referring to the same event in a single Case and again reduces the human workload.
Manually insertion
The platform also permits manually inserting a Case’s flow management; an exceptional situation detected from a source external to the xDR Data-feed could also be inserted and managed in the same customer contest.
Case categorisation management
Each case gets a specific classification from the Virtual Analyst. Humans can always manually change this classification to take control in doubting situations.
AI and Humans management console
Setting setup console permits accordantly incident typology to assign the management to AI or humans. That’s to help the Security Team manager or SOC manager to refine the design a flow accordantly the uniqueness of each customer and a possible requested SLA.
