IncMan for CSIRTs

Security Orchestration, Automation and Response for Computer Security Incident Response Teams.

Download the Full Solution Brief


As attacks have become more sophisticated, the need for Computer Security Incident Response Teams (CSIRTs) has grown. The number of simultaneous processes required in a typical forensic or incident response and evidence collection scenario is constantly expanding. Such processes need to be standardized and must perform clearly defined actions based upon international standards and established best practices while being fully documented.

IncMan SOAR for CSIRTs is an intuitive platform comprising of a number of advanced features for managing complex security incidents and digital forensics investigations. It orchestrates the entire incident and investigation lifecycle, providing measurable, repeatable and enforceable processes to minimize and control the damage resulting from an incident.

It provides computer security incident response teams with capabilities to define roles and responsibilities of incident response stakeholders, to characterize incidents, as well as the relationships to policies and procedures and reporting requirements.

Incident Response Management

Support Complex Incidents

Providing advanced incident response capabilities supports investigators in performing incident, evidence and record management. CSIRTs immediately gain the benefits of the core platform capabilities such as repeatable and measurable workflows, a dedicated knowledge base and comprehensive incident reporting. It can be utilized as a centralized platform for efficient preparation of notes, management of forensic images with automatic upload of acquisition data, snapshots and bookmarks, as well as documenting and generating chain of custody reports.

Comprehensive Case Management

Manage, Store and Report

Its case management functionality is designed for managing, storing and reporting on information gathered during digital investigative operations with segregation of duties, incident categorization, and a knowledge base module for defining policies and procedure. It includes advanced reporting and integration with common forensic tools to support investigators in performing incident, evidence and records management.

Orchestration and Automation

Enrich, Triage and Contain

Enabling full incident lifecycle automation, including threat intelligence gathering, risk assessment, triage and notification, context enrichment, hunting and investigating, and threat containment, combined with orchestrated processes and workflows, CSIRTs can respond to, track, predict and visualize any cyber security incident. By ingesting and aggregating the output of third party security devices such as SIEMs and EDRs, as well as Threat Intelligence and Malware Analysis services, CSIRTs can automate and orchestrate the correlation and fusion of all disparate intelligence sources.

IncMan SOAR for CSIRTs at a Glance.

Here is a snapshot of benefits that IncMan SOAR offers to Computer Security Incident Response Teams:

Security assessment and cost analysis

Assess costs, financial impact and time spent associated with an incident, including the technical and non-technical repercussion

Incident response case management with data segregation and role-based access

Deploy as a multi-tenant solution with granular role-based access. Business units can have their own dedicated virtual CSIRT

Artifact handling

Forensic evidence and artifacts can be stored in a centralized repository

Metrics, advanced reporting and correlation engine

Generate key metrics and customized KPI reports for supervisors and managers including a correlation engine that correlates all relevant IOCs and artifacts between incidents

Forensic evidence collection

Integration with forensic duplicators, eDiscovery management, evidence management in a dedicated forensic laboratory and an extensive inventory of all forensics capabilities

Evidence tracking and standardized labels

Chain of custody reporting for easy tracking of evidence including barcode labeling as well as CSIRTs standardized incident/host/evidence/clone labels

Knowledge base module

IncMan SOAR includes a knowledge base module to document playbooks, threat assessment, situational awareness and to transfer best practices from experienced to novice analysts and share knowledge across the CSIRT

Fully customizable and dynamic user interface

Customizable dashboards and widgets to view and track the status of incidents and the performance of the CSIRT

Simplicity of Deployment

IncMan SOAR is easy to deploy in multiple configurations suitable for bespoke CSIRTs.

  • High availability and load balancing
  • Multitenant architecture
  • Scalable incident response platform, can be integrated with NAS and SAN

Speak to one of our representatives to find out more.

Seamlessly Integrate and Orchestrate Your Tools Together as One.

Improve efficiencies by enabling your security analysts to access and manage all tools, technologies and processes from one intuitive platform.

IncMan SOAR supports hundreds of 3rd party security technologies via QIC, API, CEF, Syslog and Email, with a constantly growing list of certified bidirectional integrations and Open Integration Framework for custom integrations.

View all integration partners

Get Started with a One-to-One Personalized Demo

Dramatically reduce the mean time to detection, response and remediation of all potential security incidents, ensuring no alert goes untouched.

See IncMan SOAR in Action.

Request a demo