Incident/Event

[johnwunder]

The development of one or more SDOs to capture incident and event information.

Work area: Working Concepts

Scope

The capture of information related to internal security events, internal security incidents, and external security-relevant events.

Examples

• A malware infection on an internal laptop
• Tracking an incident response to an APT intrusion
• A threat actor changes a C2 domain
• Reporting an incident to a third-party, such as US-CERT or DC3
• Public incident repositories, such as VERIS

Open Questions

• Is there a single SDO to capture both incident and event information?
• If so, how is the status "incident" captured?
• Do you need to distinguish between internal, security-relevant events and external information?
• How do you track workflow/timestamps?
• How do you track POCs?
• How is it related to observed data?

[skelley1]

This has been pushed from the 2.1 since we did not agree on a proposal.