Incident management team

A security analyst in an incident management team is responsible for monitoring and responding to cases, assigning and resolving tasks, and analyzing data. Security analysts use IBM Security QRadar SOAR to manage incidents, respond to tasks, perform statistical analysis, and more.

An incident is an event in which data or a system might be compromised. IBM Security QRadar SOAR allows these incidents to be entered by users or systems that are integrated with it. You can then monitor the status from the start to resolution.

An incident in IBM Security QRadar SOAR can contain the following objects:

• Task: a unit of work to be accomplished by a user, device, or process. IBM Security QRadar SOAR handles some tasks automatically. You can be assigned tasks to do manually and mark them those tasks as done when you complete them. Incident owners can track the progress of the various tasks.
• Note: text added to an incident or task for clarification or additional information.
• Attachment: a file that is uploaded and attached to an incident or task.
• Artifact: data that supports or relates to the incident. Artifacts are organized by type, such as file name, MAC address, suspicious URL, MD5 and SHA1 file hashes, and more. An artifact can also have an attachment, such as an email, log file, or malware sample. Artifacts with the same value but in different incidents can be shown as related.