Security Incident Response cloning best practices

mariedutton
Tera Contributor

Hello SIR Experts,

Does anyone have a tried and true/battle-tested documented procedure for what to exclude/preserve/cleanup in a clone from production down to the lowers to prevent security incident data from being exposed anywhere other than production. We want to be able to let sys admins have sn_si.admin in the lowers for development purposes, so the production data needs to be excluded. Claude and I created a procedure with what I think are the logical tables in the sn_si and sn_ti and other sn_sec_cmn scopes and a script to clean up  attachments, journals and integration creds. It feels pretty complete to me. But I figured it wouldn't hurt to ask if anyone out there had any experience with this, gotchas to pass on, or even a "no warranty-as-is" process doc that has been used IRL.

Thank you,

Marie

0 REPLIES 0