Role: Incident Response Team

Relationships


Primary Performs	O13.1 Preparing to handle incidents O13.2 Definition of indicators O14.1 Incident analysis O14.2 Incident priorization O14.3 Incident communication O14.4 Evidence storage O15.1 Short term containment O15.3 Long term containment O15.4 Recovery O15.5 Visualization of the status of the Big Data ecosystem O16.1 Write documentation O16.2 Continuous improvement
Additionally Performs	O15.2 System check
Modifies	Communication plan Incident information Lessons learned List of actions taken List of Events List of incident analysis resources List of incidents List of primary actions taken List of sources for indicators RACI matrix for incidents Security Requirements Status of the Big Data ecosystem

Main Description

According to SANS organizacion, the incident response team main function is to react in a timely fashion, to intrusions, types of theft, denial of service attacks and many other events that have yet be to executed or considered against their company. The IRT will be responsible for investigating and reporting on malicious insider activity, internet spam, human resource violations and copyright infringements.