Logsign Unified SecOps Platform collects data, analyzes it and visualizes it. In addition, Logsign offers many features that automate and facilitate incident response. It offers an incident management and response solution prepared with one-click fast response, ready-made analysis cards and MITRE Matrix approaches.
All incidents that occur in the system can be accessed from the "Incidents" menu at the top of the Logsign web interface. On the Incidents page, values such as count, priority, risk score, status, owner and category can be followed for each incident. Analyses can be performed and the action module can be used.
When an incident is clicked, the incident card opens on the right side of the page.
All the detailed information of the incident can be accessed by clicking the "More" button on the incident card.
The incident detail screen has three tabs: "Timeline", "Artifacts" and "MITRE Attack". The Action Object, risk score value, artifact and entity information can be seen on this screen. In addition, the number of times the incident was triggered and the previous responses can be tracked.
The "MITRE Attack" tab shows which MITRE ATT&CK tactics and techniques the triggered alerts belong to. The MITRE ATT&CK information of an alert is defined in the alert rule, under Settings > Alerts & Incidents > Alert Rules.
NIST Response Stages (Analysis, Containment, Eradication, Recovery, Post Incident) for the incident can be followed in the upper right section, and the one click response feature can be used with the action button in the lower right corner, which opens the "Actions" window.
Third party investigation tools (AbuseIPDB, VirusTotal, IBM X-Force), security devices and LDAP integrations are available to be used in the action module.
Investigation results are added to the incident for enrichment, and the response results can be seen in the incident detail screen.
After the incident is resolved, it can be closed with the "Close" button. A reason must be selected while closing: False Positive, True Positive, No Action, Resolved or Other. A comment can be added, and it is required when "Other" is selected.