Event Management for Security Incident Response - Solution Brief

[Jon Williams]

Event Management Solution Brief Attached

Please respond with any comments or suggestions. Feedback is greatly appreciated and helps to improve the content.

[Alex Cox]

Man this is fantastic!

I can tell at first glance this is going to help a lot of people.

Thanks for putting this together sir.

[bianca_vaccarin]

This is really awesome Jon! For those who land on this, and are wondering what this document contains -- here are the objectives. For anyone planning on using Event Management for Security Incident response it's a great starting point:

The objectives of this document are to:
1. Describe how Event Management for Security Incident Response works
2. Provide a description of protections and domain separation that exist to prevent unauthorized access
3. Provide suggested configuration methods of Event Management for Security Incident Response
4. Present potential Use Cases for Security Incident Response – Event Management, along with benefits and challenges with each
5. Provide resources and present the information needed to determine Why or When Security Incident Response - Event Management is right to use

[Ravish Shetty]

Hi Jon, thanks for this article. 

quick question: I activated security incident response in our Madrid dev instances but I can't find anything to set up around event management. so should we explicitly activate the event management plugin too?

[jing3]

Thanks Jon.