In the overall field of cybersecurity, incident response is the strategy that covers how teams, organizations, and tools respond to security events. Typically, you use an incident response plan (IRP) to outline the practices and resources used during cyber security events. While there is much to be said about the composition of an IRP, this article focuses on incident response tooling, including an overview of different IR tools and a review of top open source solutions.

What Is Incident Response?

Incident response (IR) is a strategy you can use to respond to and recover from security incidents. It includes procedures and processes for detecting, identifying, halting, and recovering from an incident. It also typically includes steps to protect your systems from future attacks by applying knowledge gained during response.

Incident response is performed via an incident response team using an incident response plan. The primary goals of both team and plan include reducing the:

• Number of affected systems and users in an incident
• Length and depth of attack
• Amount of damage inflicted by an attack
• Length of recovery time
• Cost of remediation and recovery

Types of Incident Response Tools

When implementing your incident response strategy, there are a variety of tools you can incorporate. These tools can help your teams respond faster and more effectively to most incident types. Many tools can also help you automate monitoring and responses, allowing you to better optimize your resources.

Below is a breakdown of the most commonly used tools:

Top Open-Source Incident Response Tools

Depending on the level of protection you need and the amount of in-house expertise you have, there are numerous open-source tools you can use. Below are five of the top tools you should consider.

GRR Rapid Response

GRR Rapid Response is an incident response framework, developed by Google, that you can use to investigate incidents and collect forensic evidence. It is composed of a client, deployed on the systems you want to investigate, and a server that provides a web-based GUI and API endpoint. GRR Rapid Response is designed to enable you to perform forensic analyses at scale and can operate on hundreds of thousands of machines.

Features of GRR Rapid Response include:

• Client libraries in Python, Go, and PowerShell
• Data export in a variety of formats
• Automated scheduling capabilities
• Asynchronous messaging for scalability

AlienVault OSSIM

AlienVault OSSIM is a SIEM that was recently incorporated into AT&T’s cybersecurity offerings. It incorporates information from the AlienVault® Open Threat Exchange® (OTX™) to ensure that your system is protected with the latest threat information.

You can use AlienVault OSSIM on-premises or in virtual environments, such as the cloud. However, the open-source version can only be deployed on a single server. If you want to federate servers, you can upgrade to the paid version.

Features of AlienVault OSSIM include:

• Asset discovery
• Vulnerability assessments
• Intrusion detection
• Behavior monitoring
• Event correlation

Malware Information Sharing Platform (MISP)

MISP is a threat intelligence sharing platform you can use to gather, store, correlate, and share threat intelligence. This includes indicators of compromise (IoCs), vulnerability information, financial fraud data, and counter-terrorism information. The purpose behind MISP is to enable organizations to help each other more accurately identify threats and develop methods for detecting threats sooner.

Features of MISP include:

• Database of IoCs
• Automated correlation engines
• Flexible data model
• Intuitive user interface
• Ability to export and import data in a variety of formats

TheHive

TheHive is a four in one incident response platform that integrates with MISP. It is designed to enable security teams to collaborate in real-time, monitor systems from a central dashboard, and automate responses. TheHive incorporates another tool, Cortex, that enables you to analyze and automate the collection of network observables. For example, IP addresses, URLs, or hashes.

Features of TheHive include:

• Integrated analysis engine
• Integrated threat intelligence platform
• Authentication support
• Case and alert management capabilities
• Custom dashboards and reporting

Cyphon

Cyphon is an incident management and response platform that you can use to collect, process, and triage event data. It can collect data from a wide range of sources, including endpoint agents, IDS solutions, packets, vulnerability scanners, and cloud APIs. To use Cyphon, you need to be able to host a Docker container as the platform is designed as a set of microservices.

Features of Cyphon include:

• Data aggregation
• Centralized dashboard
• Custom alerting with push notifications
• Event prioritization
• Response tracking

Conclusion

As digital transformation continues to sweep over the globe, more data makes its way into the digital sphere. This is cause for celebration for hackers, who enjoy an increase in the resource they can steal, ransom, sell, and mine for crypto purposes. However, not every attack needs to result in a breach.

With the help of incident response tooling, you can ensure that your devices, systems, and networks are monitored continuously. You can set up your IR tools to alert you during an incident, so you can respond swiftly, counter the attack, and prevent a breach on your systems. For efficient response, be sure to centralize controls, and configure alerts with as less false positives as possible.