Reference no: EM133040512

There are two types of network management events: incidents and events.

An incident occurs when something unexpected happens on your network, while an event occurs when something unexpected happens inside Entuity.

More than one type of event can summon, alter, and resolve an incident. An incident demonstrates the persistence of an event.

This distinction between incidents and occurrences is critical in managing the data that enters Entuity appropriately.

There was an incident, and there was an event. Cycles of Life

When an event is raised, it gives information about the state of an object. When the event was raised, a concern or anomaly was described as an event, along with the type of concern/anomaly, component identity, severity, and further details. In other words, it doesn't inform you whether or not the problem persists.

An incident is a persistent condition on your network that is updated by the related events. The information contained in incidents is identical to that in events. However, incidents also show the present state of the problem. Events can open, close, and reopen incidents at any point in time. When looking at an incident's specifics, you may see the events that led to it being opened, closed, and reopened multiple times.

It is standard practice to remove incidents and events from the system seven days after they expire.

The intensity of an Event or Incident

Events always have a severity level that can be set on the Events Administration page and through the actions associated with them. The incident inherits the event's greatest severity level. The severity level of an incident is inherited when it is raised by an event having a severity level of Major or Critical.

Assignment of Events and Incidents

Events cannot be assigned to specific individuals, but incidents can.

Description of Occurrence/Event Annotation

Incidents can be annotated, whereas occurrences aren't.

Processing Done Before and After Storage

You can arrange the Event Management System to process incoming events before and after they are recorded in the database. After these first two stages of an incident have occurred, incident processing takes place. Because issues only appear once Event Management System intelligence has been applied, the Incidents dashboard is the best method to see what's going on in your network at any given time.

Incidents can be opened and closed in a variety of ways depending on the degree of intricacy of the link between the events and incidents.

If an incident can be raised by more than one type of event, and an incident can be closed by more than one type of event

When a specific event type raises and closes an incident, and another event type modifies the incident's status.

Q) Describe the importance of the containment, eradication, and recovery steps.

Question is based on the textbook and it can be used as a primary source of information. You are welcome, but not required, to use other sources. Please mention the references as Social networking sites, crowdsourcing sites, social collaboration sources such as wikis and Wikipedia are not credible. (textbook: Cybersecurity fundamentals by ICASA)