MANAGING WORKFLOWS UPON A SECURITY INCIDENT

摘要

Systems, methods, and software described herein provide for managing service level agreements (SLAs) for security incidents in a computing environment. In one example, an advisement system identifies a rule set for a security incident based on enrichment information obtained for the security incident, wherein the rule set is associated with action recommendations to be taken against the incident. The advisement system further identifies a default SLA for the security incident based on the rule set, and obtains environmental characteristics related to the security incident. Based on the environmental characteristics, the advisement system determines a modified SLA for the security incident.

主权项

1. A method of managing service level agreements (SLAs) for security incidents in a computing environment, the method comprising:
identifying a rule set for a security incident based on enrichment information obtained for the security incident, wherein the rule set is associated with one or more action recommendations to be taken against the security incident; identifying a default SLA for the security incident based on the rule set; obtaining environmental characteristics related to the security incident; determining a modified SLA for the security incident based on the environmental characteristics.