ServiceNow CIS - Security Incident Response: key terms

Flashcards for this exam ServiceNow CIS - Security Incident Response guide Class dates

• Data EnrichmentAdding context, such as threat intelligence, asset criticality, user identity or geolocation, to events and alerts.Intermediate
• EscalationTransferring an alert or incident to a higher tier, specialist team or management according to defined criteria.Foundational
• Incident SeverityA classification of an incident's urgency and impact used to prioritize response and escalation.Foundational
• PlaybookA documented or automated set of steps for responding to a specific type of security incident or alert.Foundational
• Security IncidentAn occurrence that actually or potentially jeopardizes the confidentiality, integrity or availability of information or systems, or violates security policy.Foundational
• Security Operations (SecOps)ServiceNow suite including Security Incident Response, Vulnerability Response, Threat Intelligence and Configuration Compliance.Foundational
• ServiceNow Security Incident Response (SIR)A ServiceNow application for managing security incidents with workflows, playbooks, threat intelligence and integrations.Advanced
• Threat IntelligenceServiceNow application that manages indicators of compromise and threat feeds, enriching security incidents.Intermediate
• TriageRapidly assessing alerts or incidents to determine validity, severity and priority for response.Foundational