State of the Practice of Computer Security Incident Response Teams ...

formats for exchanging incident data between teams. For example, the IODEF defines a
common data format for describing and exchanging incident information [Arvidsson 01].
IODEF has been designed to be compatible with the Intrusion Detection Message Exchange
Format (IDMEF) developed for sharing intrusion detection data between intrusion detection
systems [Curry 03]. More about this project can be found in Section 3.10.2.1 of this report.
3.7.5.2 Mechanisms for Recording and Tracking Incident Information
Information can be captured and logged in a variety of ways: on paper or in a logbook, in a
database or help desk system, or even in text files.
When participants were queried in the CSIRT Organizational Survey about how information
was collected, they responded as follows:
• 76% of the teams stated that they used a database to record and track incident data
• 28% use both a database and a paper log
• 10% use only a paper log
• 45% said they used a customized database
• 28% said that they used an off-the-shelf product
There was no particular database product used consistently by the CSIRTs. Products mentioned
included
• Remedy HelpDesk and Action Request System
• SQL
• Oracle
• Microsoft Access
• Lotus Notes
A number of teams find they must build customized environments to collect, record, and
store CSIRT information because some of the tools do not have the features needed or do not
meet the functionality required by the CSIRT.
One example of some of the work that is currently being done to create a customized incident
handling tracking system is the development of Request Tracker for Incident Response
(RTIR). 96 JANET-CERT is currently funding a project that has led to the development of
RTIR, which is a customized version of an earlier general-purpose tracking system called
96
For more information, see .
94 CMU/SEI-2003-TR-001