Co-Managed SIEM

Use Cases for Incident Response Service

Choosing an incident response provider is kind of like choosing an insurance policy: It’s only proven in the heat of a bad situation, so some effort should be made at the outset of the relationship to determine exactly what’s going to happen during an IR event.


What Should an IR Team Provide After an Incident?

Transparency in the interest of learning and preventing future compromise is a critical element of an IR program. All steps should lead toward a more mature security posture, and any successful attacks should be a learning experience for everyone involved. In the wake of an incident, an IR team should provide the following documentation to help glean any useful knowledge from the event:

  • Incident Declaration Report
  • Initial Assessment of Incident
  • Daily / Weekly (as applicable) Status Reports of the investigation

Learn more about what Novacoast provides in our Incident Response Program.