Overview
UTMStack’s incident management system provides comprehensive capabilities for tracking, investigating, and responding to security incidents. The incident response workflow is accessible at/incident and integrates with alerts, SOAR automation, and threat intelligence to streamline security operations.
Incident Tracking
Centralized tracking of all security incidents
Response Coordination
Collaborate with team members on incident response
Automated Workflows
Leverage SOAR playbooks at
/soar for automated responseEvidence Collection
Document and preserve incident evidence
Incident Lifecycle
Incident Phases
Incidents in UTMStack follow a structured lifecycle:Incident Statuses
New
Incident created but not yet assigned
Assigned
Incident assigned to analyst for triage
Investigating
Active investigation in progress
Contained
Threat contained, eradication in progress
Resolved
Incident fully remediated and closed
False Positive
Determined to be benign activity
Incident Attributes
Core Information
Each incident includes:- Incident ID - Unique identifier (e.g., INC-2024-0001)
- Title - Brief descriptive name
- Severity - Critical, High, Medium, Low
- Status - Current phase in incident lifecycle
- Priority - Response priority (P1-P5)
- Category - Incident type (Malware, Phishing, Data Breach, etc.)
- Created Date - Incident creation timestamp
- Assigned To - Primary incident responder
- Related Alerts - Source alerts from
/iframe - Affected Assets - Impacted systems from
/data-sources - Description - Detailed incident summary
Classification
Incident Categories
Malware Infection
Malware, ransomware, or trojan detections
Phishing Attack
Email-based social engineering attempts
Unauthorized Access
Credential compromise or unauthorized login
Data Exfiltration
Potential data theft or unauthorized transfer
Denial of Service
DoS/DDoS attacks affecting availability
Policy Violation
Security policy or compliance violations
Insider Threat
Malicious or negligent insider activity
Web Attack
Web application exploitation attempts
Severity Levels
| Severity | Definition | Response Time | Examples |
|---|---|---|---|
| Critical | Severe business impact, active breach | 15 minutes | Ransomware outbreak, active data breach |
| High | Significant impact, confirmed compromise | 1 hour | Confirmed malware on critical server |
| Medium | Moderate impact, potential compromise | 4 hours | Suspicious user activity, policy violation |
| Low | Limited impact, informational | 24 hours | Failed login attempts, minor violations |
Incident Response Workflow
Creating an Incident
Enter Incident Details
- Title and description
- Category and severity
- Affected assets from
/data-sources - Related alerts
Investigation Process
Gather Context
- Check threat intelligence at
/threat-intelligence - Review asset information at
/data-sources - Query logs at
/discoverfor related activity
Determine Scope
- Timeline of attacker activity
- Full list of affected systems
- Data or systems accessed
- Persistence mechanisms
Assess Impact
- Business systems affected
- Data potentially compromised
- Regulatory notification requirements
Containment Actions
Common containment measures:Network Isolation
Isolate affected systems at network or host level
Account Suspension
Disable compromised accounts via
/active-directoryBlock IOCs
Add malicious indicators to blocklists via integrations
Endpoint Quarantine
Quarantine endpoints through EDR integration
Access Revocation
Revoke access tokens and force re-authentication
Traffic Blocking
Block malicious IPs/domains at firewall or proxy
Eradication and Recovery
Remove Malicious Artifacts
- Delete malware files
- Remove backdoors and persistence
- Clean registry keys and scheduled tasks
SOAR Integration
Automated Response Playbooks
Trigger automated workflows from/soar for common incident types:
Malware Response
- Isolate host
- Collect forensic artifacts
- Submit samples for analysis
- Block IOCs across infrastructure
Phishing Response
- Delete malicious emails
- Disable sender
- Extract and block IOCs
- Notify affected users
Account Compromise
- Force password reset
- Revoke active sessions
- Review account activity logs
- Enable enhanced monitoring
Data Breach
- Identify exfiltrated data
- Block egress channels
- Preserve evidence
- Initiate notification workflow
Manual Playbook Execution
Evidence Management
Collecting Evidence
Types of evidence to collect:- Log Files - Export relevant logs from
/discover - Network Captures - PCAPs of malicious traffic
- Disk Images - Forensic images of affected systems
- Memory Dumps - RAM captures for malware analysis
- Screenshots - Visual documentation of findings
- IOC Lists - Documented indicators of compromise
- Timeline - Chronological sequence of events
Evidence Documentation
Collaboration and Communication
Team Coordination
Incident Notes
Real-time updates and investigation findings
Task Assignment
Distribute response tasks among team members
Status Updates
Regular updates to stakeholders and management
Handoff Documentation
Clear documentation for shift changes
Stakeholder Communication
Maintain communication with:- Executive Management - High-level status and business impact
- Legal/Compliance - Regulatory notification requirements
- IT Operations - Technical coordination and system access
- Business Units - Affected department notifications
- External Parties - Law enforcement, vendors, customers (if required)
Metrics and Reporting
Incident Metrics
Track key performance indicators:- Mean Time to Detect (MTTD) - Time from incident start to detection
- Mean Time to Respond (MTTR) - Time from detection to containment
- Mean Time to Recover - Time from containment to full recovery
- Incident Volume - Total incidents by period
- Incident by Severity - Distribution across severity levels
- Incident by Category - Common incident types
- Response Effectiveness - Successful containment rate
Incident Reporting
Generate reports for:Executive Summary
High-level overview for management from
/dashboardTechnical Report
Detailed technical findings for security team
Compliance Report
Regulatory reporting via
/complianceLessons Learned
Post-incident review and recommendations
Post-Incident Activities
Post-Incident Review
Continuous Improvement
Apply lessons learned:- Detection Enhancement - Add new rules at
/alerting-rulesfor similar threats - Response Automation - Create SOAR playbooks at
/soarfor recurring scenarios - Tool Improvements - Deploy new integrations at
/integrationsto fill gaps - Training - Conduct tabletop exercises based on real incidents
- Documentation - Update response procedures and runbooks
Best Practices
During Incidents
- Document Everything - Real-time notes are critical for post-incident analysis
- Communicate Frequently - Keep stakeholders informed of status
- Follow Procedures - Adhere to established runbooks and playbooks
- Preserve Evidence - Follow forensic best practices
- Think Before Acting - Rushed actions can destroy evidence or worsen impact
Incident Management
- Clear Ownership - Every incident has a designated owner
- Status Updates - Update incident status as it progresses through lifecycle
- Consistent Categorization - Use standard categories and severities
- Link Related Items - Associate alerts, assets, and evidence
- Close Loop - Always complete post-incident review
Related Resources
Alert Management
View and triage security alerts
SOAR Automation
Automate incident response actions
Threat Intelligence
Enrich incidents with threat intel
Log Discovery
Investigate events and gather evidence