Skip to main content

A-008 - Incident Response Capability

Purpose​

Provide the ability to detect, analyze, contain and respond to security incidents affecting the Scheol Security Lab.

Asset Type​

  • Business Capability

Description​

  • Defines how security incidents are handled across the lab
  • Covers detection intake, triage, investigation and response actions
  • Includes both technical tooling and procedural aspects

Criticality​

  • High
  • Incident response directly impacts the ability to limit damage and restore trust after compromise

Sensitivity​

  • Sensitive
  • Involves access to logs, alerts, system states and potentially compromised data

Exposure Level​

  • Internal only
  • Operates within trusted administrative and monitoring zones

Trust Zone​

  • Hell

Dependencies​

  • Monitoring & Detection (A-006)
  • Administrative Access (A-001)
  • Logging infrastructure
  • Potential future SOAR platform (TheHive, Cortex)

Relationships​

  • Uses Monitoring & Detection outputs
  • Interacts with all infrastructure and platform assets during incidents
  • Supports risk validation and control effectiveness assessment

Security Position (Architecture Context)​

  • Not directly exposed but critical in post-compromise scenarios
  • Acts as a response layer within the security lifecycle
  • Strongly dependent on visibility and access capabilities

Existing Protective Measures​

  • Currently limited to manual investigation and log analysis
  • No formalized incident response workflow yet
  • No centralized alerting or case management platform at this stage

Owner / Responsibility​

  • Security Role (Sec)

Notes​

  • Capability currently at early maturity stage
  • Strong dependency on future deployment of monitoring stack (Wazuh, SIEM)
  • Formal playbooks, response procedures and tooling integration are planned