Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I m trying to find a good way to deal with incidents. For now these are my thoughts:

x Join Logs and analyse with splunk (and alert with rsyslog, splunk is too expensive),

x Configuration-Management and automatic Re-Deployment (puppet, capistrano),

x Forensic via File-System-Mounting (compare with clean hash-db), Analyse Memory-Dumps for Rootkits (volatilitux)...

I would really appreciate some comments, that help me improves.

incident response

share|improve this question
What do you mean Splunk is too expensive? Computationally expensive? – Steve Apr 3 '11 at 16:42
@SteveS: No, money. Monitoring and Alerting is available in the enterprise edition. that starts at 5000 $ per year. for the free edition there is a 500mb per day limit. – baj Apr 3 '11 at 20:21
Initial comment would be that any flow chart ending with a box containing a '?' needs further work. Some good comments below on this from 'Wicky' to help you out. – David Stubley Apr 5 '11 at 8:00

Assuming that this is your complete process, not a subset where other decisions have already been made, I would suggest that your first decision point is not whether or not there is an intrusion but whether or not there is a business service impact.

Alert -> Check Logs -> Business Service Impact?

After you've determined the business service impact you can use that to drive the rest of the incident response. If your service is impacted you need to engage the correct people in the business (which should already be documented) to notify them of the impact, providing an early overview of the problem.

Business Service Impact? -> Yes -> Notify Business Incident Manager

Once the business has been notified you can move on to determining the exact nature of the problem and working through the rest of your process flow.

If there is no business service impact you still move on to problem determination.

Business Service Impact -> No -> Intrusion?

My next point would be that, even if the event is not an Intrusion it may still be a security event which you wish (or need) to perform actions as a result of.

For example, you detect some form of automated or manual scan of your web applications. You may decide that you wish to block the attacker's IP address. This is just one simple example.

Such a decision may require authorisation from appropriate business or technology representatives so again, the necessary hooks in to the business must be reflected in your process flow.

In summary then, my feedback points are:

  1. Don't forget you're defending a business application, ensure your incident response process reflects the needs of the business, not just detailing the technical steps required.

  2. An intrusion is obviously worst case but don't discount actions required for other security related events. It may not just be mis-configuration.


share|improve this answer
Thx for your answer. That is really a good point. I ll insert the Business Impact. – baj Apr 11 '11 at 9:06

OSSIM has OSSEC. OSSEC can be used on things like mod-security, Wordpress, and MySQL UDF logging interfaces, in addition to file integrity monitoring and syslog management.

I don't understand the need or desire for Splunk when Novell Sentinel Log Manager 25 and Q1Labs QRadar Log Manager have freely downloadable options that are better, in addition to plenty of other open-source projects that are also better (especially for the price). I agree that Splunk is too expensive.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.