Summary

In this chapter, you have taken the lessons from previous chapters and learned how they apply when data you’ve previously learned how to collect, analyze, and store reveals there may be a possible true positive incident occurring. That is to say, you’ve begun to gain a feel for the part of cybersecurity defense known as incident response.

In the course of responding to incidents, it helps to have tools at your disposal, especially when automation is included, and with that, you were introduced to a security orchestration automation and response platform known as Cortex. You learned about an incident response case management platform known as TheHive, which feeds its data into Cortex for processing and gets it returned with many potential automation activities performed on the data.

You also got a glimpse of the MISP. This open source project was selflessly created for the purpose of helping all of us to work together to stop the malicious activities of bad...