.png?width=200&height=50&name=cydarm%202024%20logo%20blue%20on%20transparent%201000x250%20(3).png)
Overview
Cydarm comes pre-configured with a standard incident response lifecycle aligned with international frameworks like NIST SP 800-61. This provides a structured path for managing security events from initial detection through to final resolution.
Default incident lifecycle
When an alert or case is created, Cydarm guides your team through seven progressive stages:
1. Triage
- Purpose: Rapid initial assessment. Analysts determine whether the alert is a true positive, evaluate preliminary impact, and decide if it requires full escalation.
- Tracking: Often paired with target response timers or Service Level Agreements (SLAs) to prevent critical alerts from sitting unaddressed.
2. Analysis
- Purpose: Deep technical investigation. Analysts collect evidence, gather threat intelligence, correlate Indicators of Compromise (IOCs), and establish the scope of malicious activity or exposure.
3. Containment
- Purpose: Immediate tactical mitigation to prevent lateral movement or ongoing damage. Common actions include isolating endpoints, blocking malicious IPs, or revoking compromised credentials.
4. Eradication
- Purpose: Complete removal of the threat from the environment. This step addresses root causes by deleting artifacts, purging malicious persistence mechanisms, and patching exploited vulnerabilities.
5. Recovery
- Purpose: Safely restoring impacted systems and services to production. This phase covers rebuilding hosts from clean images, restoring data, rotating credentials, and performing heightened post-incident monitoring.
6. Pending Closure
- Purpose: Administrative completion. Active technical remediation is finished, but the case remains in this holding state while completing post-incident reviews, finalizing formal reports, and securing internal approvals. It serves as a final quality-assurance checkpoint by keeping the case visible to managers as "nearly done" without letting it clutter the active, high-priority operational pipeline while the paperwork is being signed off.
7. Closed
- Purpose: The investigation is concluded. The record is archived from active queues and retained for reporting, SLA audit trails, and compliance metrics.
Understanding the Workflow Transition Graph
At the top of the Transition Rules tab, an interactive graph maps every case status and the permitted paths between them:
- Blue nodes: Represent start states where a case can originate.
- Green nodes: Represent end states where a case reaches final resolution.
- Arrows: Indicate allowed unidirectional or bidirectional transitions between stages.
Built-in guard-rails
In newer versions of the platform, the transition between these default stages can be enforced with automatic guardrails configured on install:
- Assignee enforcement: The platform can block a case from moving to the next stage until an owner is explicitly assigned.
- Tag and metadata rules: Restricts cases from moving forward until mandatory fields or categorization tags (such as attack vector or classification) are completed.