{"action":"opened","issue":{"url":"https://api.github.com/repos/simcen/alert_manager/issues/224","repository_url":"https://api.github.com/repos/simcen/alert_manager","labels_url":"https://api.github.com/repos/simcen/alert_manager/issues/224/labels{/name}","comments_url":"https://api.github.com/repos/simcen/alert_manager/issues/224/comments","events_url":"https://api.github.com/repos/simcen/alert_manager/issues/224/events","html_url":"https://github.com/simcen/alert_manager/issues/224","id":353101099,"node_id":"MDU6SXNzdWUzNTMxMDEwOTk=","number":224,"title":"Add \"DOD Category\" to incident","user":{"login":"jonwalthour","id":4494038,"node_id":"MDQ6VXNlcjQ0OTQwMzg=","avatar_url":"https://avatars1.githubusercontent.com/u/4494038?v=4","gravatar_id":"","url":"https://api.github.com/users/jonwalthour","html_url":"https://github.com/jonwalthour","followers_url":"https://api.github.com/users/jonwalthour/followers","following_url":"https://api.github.com/users/jonwalthour/following{/other_user}","gists_url":"https://api.github.com/users/jonwalthour/gists{/gist_id}","starred_url":"https://api.github.com/users/jonwalthour/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jonwalthour/subscriptions","organizations_url":"https://api.github.com/users/jonwalthour/orgs","repos_url":"https://api.github.com/users/jonwalthour/repos","events_url":"https://api.github.com/users/jonwalthour/events{/privacy}","received_events_url":"https://api.github.com/users/jonwalthour/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2018-08-22T19:57:34Z","updated_at":"2018-08-22T19:57:34Z","closed_at":null,"author_association":"NONE","body":"Currently in Incident Posture (Alert Manager) we have these fields to choose from:\r\n_time\r\nowner\r\nstatus_description\r\ntitle\r\napp\r\ncategory\r\nsubcategory\r\ntags\r\npriority\r\n\r\nWe would like an additional field that can be CHANGED via drop down to reflect which stage of the Categorization process the alert is at.  \r\n \r\nNOTE:  we cannot use either the “category” or “subcategory” or “tags” as these are statically defined and used to group alerts.   Changing one would impact all other alerts.   The new drop down would allow us to select the CAT for that specific alert and no other alerts.  I could have 3 Malware Detected and Not Handled and each one could be at a different CAT assignment. \r\n \r\nCategories 1, 2, 4, and 7 are the most severe and therefore labeled as incidents.  Everything else is an event.  Cases are generally opened as a CAT 8 and then reclassified as investigation proceeds.  \r\n \r\nUser of Incident Posture (Alert Manager) could configure all alerts to come in with a CAT 8 (Investigating) status then change it as that investigation further identifies and confirms what its true categorization is.  \r\nReference:  Chairman of The Joint Chiefs of Staff Manual http://www.jcs.mil/Portals/36/Documents/Library/Manuals/m651001.pdf?ver=2016-02-05-175710-897 – Page 51 through 53 ( B-A-1 to B-A-3) Appendix A Enclosure B “APPENDIX A TO ENCLOSURE B CYBER INCIDENT AND REPORTABLE CYBER EVENT CATEGORIZATION”\r\n \r\nCAT 1\tRoot-level Intrusion\tIncident\r\nCAT 2\tUser-level Intrusion\tIncident\r\nCAT 3\tFailed Attempt\tEvent\r\nCAT 4\tDenial of Service\tIncident\r\nCAT 5\tNon-Compliance Activity\tEvent\r\nCAT 6 \tReconnaissance\tEvent\r\nCAT 7\tMalware\tIncident\r\nCAT 8\tInvestigating\tEvent\r\nCAT 9\tExplained Anomaly\tEvent\r\n \r\nThis would allow SOCs using alert manager where in the process they were as well as more easily provide trending assessment reports."}}
{"actor":{"display_login":"jonwalthour"}}