Security Incident Response cloning best practices
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
an hour ago
Hello SIR Experts,
Does anyone have a tried and true/battle-tested documented procedure for what to exclude/preserve/cleanup in a clone from production down to the lowers to prevent security incident data from being exposed anywhere other than production. We want to be able to let sys admins have sn_si.admin in the lowers for development purposes, so the production data needs to be excluded. Claude and I created a procedure with what I think are the logical tables in the sn_si and sn_ti and other sn_sec_cmn scopes and a script to clean up attachments, journals and integration creds. It feels pretty complete to me. But I figured it wouldn't hurt to ask if anyone out there had any experience with this, gotchas to pass on, or even a "no warranty-as-is" process doc that has been used IRL.
Thank you,
Marie
