Chapter_6_Alerts & cases

Question 1

What is an alert?

Answer 1

A collection of one or more logically correlated suspicious events

Question 2

What could trigger an alert?

Answer 2

• Unexpected communication between devices
• Upload of a new firmware version to a PLC
• Communication deviating from the protocol specifications

Question 3

What is a Case?

Answer 3

• Alert cases can group related alerts together
• Cases can be configured to automatically assign new alerts
• Case status can be changed upon of investigation of the underlying problem
• Cases allow operators to focus on new threats appearing on the network,while keeping track of problems already being analyzed

Question 4

What are some of the best practices when managing cases?

Answer 4

• Change the status of alerts after they have been investigated
• Create customization rules to change the severity and/or status of alerts automatically
• Proactively adjust the whitelists of the detection engines to reduce false positives(covered in upcoming Chapters)
• Create cases for known issues
• Create additional custom filters for important events