WEBVTT 1 00:00.000 --> 00:03.200 In this video, we're going to take a big picture look at the wonderful world of 2 00:03.200 --> 00:07.230 incident management overview. And as I mentioned in the intro, incident, think 3 00:07.230 --> 00:08.480 of it like a service 4 00:08.480 --> 00:13.870 request or a ticket or an entity here on the 40 analyzer that we can use to 5 00:13.870 --> 00:14.800 input information 6 00:14.800 --> 00:19.100 into and track until it's completed. And most of the time in a security 7 00:19.100 --> 00:20.000 environment, 8 00:20.000 --> 00:24.670 it's going to be security related elements and events that are going to go into 9 00:24.670 --> 00:25.280 an incident. 10 00:25.280 --> 00:30.170 Let's also imagine that our 40 analyzer has received log information from WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 10 00:25.280 --> 00:30.170 Let's also imagine that our 40 analyzer has received log information from 11 00:30.170 --> 00:31.120 various devices, 12 00:31.120 --> 00:34.690 including our 40 gates. And we have some event handlers that have created 13 00:34.690 --> 00:36.080 events for us. Now, 14 00:36.080 --> 00:39.880 as part of the event handlers that are creating the events, we could as part of 15 00:39.880 --> 00:40.800 those event handlers 16 00:40.800 --> 00:44.630 also have them automatically take the next step and then as to go ahead and 17 00:44.630 --> 00:45.840 create an incident. 18 00:45.840 --> 00:49.950 And again, think of an incident like a ticket or a service request that's 19 00:49.950 --> 00:51.040 identifying something 20 00:51.040 --> 00:54.320 that needs to be further investigated. So this incident in this overview is 21 00:54.320 --> 00:54.800 chat about how it 22 00:54.800 --> 00:59.030 can be created. One way is we could have it created from the event handler that 23 00:59.030 --> 00:59.760 automatically creates 24 00:59.760 --> 01:03.520 it for us or the other option is we can do it manually. And when we do it WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 24 00:59.760 --> 01:03.520 it for us or the other option is we can do it manually. And when we do it 25 01:03.520 --> 01:04.640 manually, sometimes 26 01:04.640 --> 01:08.900 it's referred to in the documentation as raising an incident. So we think of 27 01:08.900 --> 01:09.920 that like, let's imagine 28 01:09.920 --> 01:14.070 we're looking at our events, we could right click and say from the dropdown, I 29 01:14.070 --> 01:15.280 want to create a new 30 01:15.280 --> 01:19.440 incident. That'd be an example of raising or we could go to the window for 31 01:19.440 --> 01:20.640 incidents and simply 32 01:20.640 --> 01:23.950 click on create new. So if you ever see the concept of raising an incident, 33 01:23.950 --> 01:24.960 think of it like we're 34 01:24.960 --> 01:28.050 creating an incident. So in this set of videos, we're going to take a look at 35 01:28.050 --> 01:29.120 the creation of an 36 01:29.120 --> 01:32.960 incident and how to manage those incidents, as well as how to do analysis of WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 36 01:29.120 --> 01:32.960 incident and how to manage those incidents, as well as how to do analysis of 37 01:32.960 --> 01:33.920 those incidents, 38 01:33.920 --> 01:37.440 and then also take a look at reporting, including creating a report based on 39 01:37.440 --> 01:38.640 the instance, or 40 01:38.640 --> 01:42.870 we could also take reports that we generate and include them as details that 41 01:42.870 --> 01:43.840 can be associated 42 01:43.840 --> 01:46.860 with that incident. So that's the big picture regarding incidents and the 43 01:46.860 --> 01:47.920 probably the best way 44 01:48.720 --> 01:52.720 understanding it is to see it in action. And we'll begin that process in the 45 01:52.720 --> 01:53.840 very next video. So 46 01:53.840 --> 02:01.600 I'll see you there in just a moment.