vPLfv

List of Tables
Table 1 Review of Incident Management Processes from Various Publications. 20
Table 2: Detect Events Workflow Example ......................................................... 32
Table 3: Key to Incident Management Process Map Symbols ............................ 42
Table 4: Incident Management Workflow Description Information Categories..... 47
Table 5: Incident Management Handoff Description Information Categories....... 48
Table 6: PC: Prepare/Sustain/Improve Workflow Description.............................. 58
Table 7:
Table 8:
Handoff from Any Activity Inside or Outside CSIRT Process to PC:
Prepare/Sustain/Improve ...................................................................... 70
Handoff from PC: Prepare/Sustain/Improve to
PI: Protect Infrastructure ....................................................................... 74
Table 9: PI: Protect Infrastructure Workflow Description ..................................... 82
Table 10:
Handoff from Any Activity Inside or Outside CSIRT Process to
PI: Protect Infrastructure ....................................................................... 88
Table 11: Handoff from PI: Protect Infrastructure to D: Detect Events .................. 92
Table 12: D: Detect Events Workflow Description............................................... 100
Table 13: Handoff from Any Activity Inside or Outside of the Organization to D:
Detect Events ..................................................................................... 106
Table 14: Handoff from D: Detect Events to T: Triage Events.............................. 110
Table 15: T: Triage Events Workflow Description ................................................ 118
Table 16: Handoff from T: Triage Events to R: Respond ..................................... 124
Table 17: R: Respond Workflow Description....................................................... 134
Table 18: Handoff from R: Respond to PC: Prepare/Sustain/Improve................. 142
CMU/SEI-2004-TR-015
vii