Development of the System for Automated Incident Management Based on Open-Source Software

Abstract

This article addresses the development of the system for automated incident management based on open-source software. The idea behind that research is to automate the information security incident management process, including reducing the processing time and incident response. Solutions of the Security Orchestration, Automation, and Response (SOAR) class were analyzed. Based on this analysis, the system for automated incident management has been developed. For the system to work without interruptions, a fault-tolerant operation scheme was designed. The system also implements centralized management with a distributed, federated architecture. This research confirmed that SOAR solutions can reduce incident response times, reduce the number of specialists in the incident management process, and automate this process.