Key Characteristics for Developing a SIR Team

[SRIRAMSANKAR007]

What are the Key characterisitcs for Developing a SIR Team and what are the things can a SIR Team can do in the SIR Workspace. Give an overview on that topic.

[sandeepdutt]

Hi @SRIRAMSANKAR007 ,

Security Incident Response application tracks the progress of security incidents from discovery and initial analysis, through containment, eradication, and recovery, and into the final post incident review, knowledge base article creation, and closure.

Use the below link to see the tiles for 2 personas "Admin" and "Analysts" using the Workspace

[sandeepdutt]

Link :

https://www.servicenow.com/docs/r/security-management/security-incident-response/sir-workspace-landi...

[Cheryl ODell]

A SIR team is usually your security operations team/analysts to log and work security incidents.  There are features like enrichment workflows to gather information the SecOps team enters on the ticket - like CMDB info, user info, and with some integrations, whois info, running through something like VirusTotal, or sending block/allow commands to the firewall.

The team supporting SIR need to know the capabilities of SIR, know how to use Workflow Studio to build flows and playbooks.  

Using the Workspace, in my opinion, is a much easier view of 'all the things' in SIR.  I push our SOC analysts to use the Workspace.

Cheryl O'Dell