Patent ID: 9697352
Date: 2017-07-04
CPC Classifications: G06F,H04L

Claim:
1. A computer-implemented incident response management system, comprising: an incident response application providing a user interface; at least one central processing unit; an operating system; a database communicably coupled to said incident response application; create an Incident Record in response to receiving from a first user, via said user interface, notification of a cyber or information security incident, together with data objects representative of entities related to said incident, files and/or data found during said incident, and/or observed actions and/or outcomes related to said incident, and store said Incident Record including said data objects; receive, from said first user via said user interface, data representative of one or more selected users authorised to access said Incident Record; provide via said user interface, only upon request from one of said selected users, an interactive representation of said Incident Record, including information represented by said data objects, to selected users; receive, only from said first user or a said selected user, via said user interface, further data objects related to said cyber or information security incident and representative of entities related to said incident, files and/or data found during said incident, and/or observed actions and/or outcomes related to said incident; and add said further data objects to said Incident Record; in response to creation of said Incident Record or addition a further data object to said Incident Record, compare said data objects of said Incident Record with a stored record of Indicators of Compromise, generate an alert if a matched Indicator of Compromise is detected, and store data representative of said matched Indicator of Compromise in said Incident Record.