# Improving Incident Response in Big Data Ecosystems by Using Blockchain Technologies
## 4 Incident Response for Big Data Ecosystems
### Identification and Analysis  
This is the longest phase, since it is developed throughout the entire operation phase of the big data environment. This phase pursues the objective of the detection and later analysis of the different incidents that occur in the ecosystem. All these activities are carried out sequentially, except for the fourth activity on the storage of events and incidents in blockchain, which is carried performed in parallel throughout this phase, the activities of which are summarized in Table 5.  
\begin{table}
\begin{tabular}{p{113.8 pt} p{113.8 pt} p{113.8 pt} p{113.8 pt}} \hline \hline
**Activities** & **Description** & **Inputs** & **Outputs** \\ \hline \multirow{4}{*}{Preparing to handle incidents} & & Event description & Communication plan \\  & & Incident description & RACI (responsible, accountable, consulted and informed) matrix for incidents \\  & Plan the different actions to be taken when an incident occurs & Repository with the prioritized risks & Communication plan \\  & & List of big data assets & RACI (responsible, accountable, consulted and informed) matrix for incidents \\  & & List of stakeholders and their roles & List of incident analysis resources \\ \hline \multirow{4}{*}{Definition of indicators} & Identify all big data resources that may indicate a security incident is occurring & List of big data assets Repository with the prioritized risks & List of sources for indicators \\ \clThe first activity is fundamental throughout the incident response process, since it is a matter of analyzing incidents to determine whether they have actually occurred, i.e., this is about detecting them. In order to carry out this activity, an analysis must be made of the indicators defined in the previous phase. This study must be conducted by the incident response team, since there may be false positives, in which an event is labelled as an incident when it is really a simple system error. To avoid these false positives, previous cases can be used to understand the behavior of the big data ecosystem better. In this type of environment, it is especially critical to emphasize the analysis of the typical functions that are performed during the operation, i.e., the preparation, analysis and visualization of the data. An intelligence system can be implemented with a view to carrying out that task. This system can use the big data ecosystem itself as an engine to perform the machine learning techniques, or it can employ another isolated system. The use of big data analytics can help the incident response team to identify patterns and threats in a more effective way. As an output of this activity, the incidents that have definitely been identified as such will be obtained. The second activity consists of categorizing the incident according to its severity. It is therefore not a good policy to treat incidents on a first-come, first-served basis. In addition to the impact made by the incident, another factor to take into account is the recoverability of the components affected. This activity is closely connected to the phase of risk assessment in the analysis and design process (see Figure 3), since this incident should be the materialization of a threat. However, it is possible that the threat was not anticipated previously; this implies the need to update the list of risks. Once the incident has been analyzed and prioritized, and based on the communications plan defined during the preparation phase, the third activity informs the responsible stakeholders so that they can carry out the necessary actions. The last activity of this phase deals with the storing of the event and incident data in the blockchain system. Our proposal has two blockchain systems running in parallel. One of them is in charge of storing the data generated by the defined indicators (event blockchain). Hence, this blockchain is connected to the main components of the big data ecosystem: the big data application provider (BDAP) and the big data framework provider (BDFP).