121 results about "Incident response" patented technology

Systems and methods for collection of volatile forensic data from active systems are described. In an embodiment of the methods, a selected set of forensics data items can be selected. Runtime code capable of launching data collection modules from a removable storage device with little or no user input is generated and stored on the device. The collection of forensic data can then be accomplished covertly using the removable storage device by a person with minimal training. In another embodiment, pre-deployed agents in communication with servers and controlled by console software can collect forensic data covertly according to schedule, immediately at the command of an analyst using a remote administrative console, or in response to a triggering event.

A method of providing rapid business support of insured property using image analysis can include the step of receiving at least one digital image of damaged property. Damage can be automatically accessed for insurance purposes based upon the received images. An incident response can be automatically determined based at least in part upon the damage assessment. Incident responses can include, but are not limited to, tendering a claim payoff offer, referring a claim to a human agent, providing repair instructions, and/or arranging for a physical damage assessment of the damaged property.

The present invention relates to methods, network devices, and machine-readable media for an integrated environment for automated processing of reports of suspicious messages, and furthermore, to a network for distributing information about detected phishing attacks.

A security management system can log, investigate, respond, and track computer security incidents that can occur in a networked computer system. In other words, the security management system can produce a security record of information related to the tracking of suspicious computer activity or actual computer security threats, such as denial of service attacks or other similar compromises to computers or computer networks. The security record can include, but is not limited to, date and times of computer security incidents, a name for a particular security incident, a security management system user, and a potential source of the computer security incident. The security record can be designed as a running log that saves or records all activity of a computer incident source as well as the activity of the security team responding to the computer incident source. To produce the security record, all data that relates to a computer incident and all data that relates to a computer incident response can be sent to a separate protected database, where data is protected by digital signature algorithms (DSAs).

Systems and methods may enable first incident responder management and support. System and methods enabled by software may utilize communications networks and location based systems such as the Global Positioning System (GPS) to locate the incident and response units, and to relay and share critical incident management information for use by other emergency response operators associated with an emergency scene. Maps and icons may be accessed and utilized over devices in the field. Software modules enable a system operator to use maps and a selection of user interface objects such as custom icons symbolizing a list of responders (police, fire, rescue, military) called forward and may designate specific geographic positions for managing a crisis.

An incident response system and method for tracking data security incidents in enterprise networks is disclosed. An Incident Manager application (IM) stores incident objects and incident artifacts (IAs) created in response to the incidents, where the incident objects include the information for the incident and the IAs are associated with data resources (e.g. IP addresses and malware hashes) identified within the incident objects. In response to creation of the IAs, the IM issues queries against one or more external threat intelligence sources (TISs) to obtain information associated with the IAs and augments the IAs with the obtained information. In examples, the IM can identify known threats by comparing the contents of IAs against TIS(s) of known threats, and can identify potential trends by correlating the created incident objects and augmented IAs for an incident with incident objects and IAs stored for other incidents.

A system on interactive tracking and inventorying of incident response equipment and associated methods is provided. The system and methods enable command centers to determine the geographic location of all available emergency response equipment that are capable of responding to an incident. The systems and methods allow the inventory to be updated as equipment and personnel are spent during the course of the incident. The location of the equipment and personnel can be viewed on a topography map, as well as an aerial map, to enable the incident command to determine the atmospheric surroundings of each piece of equipment. The maps can be superimposed so that more than one type of map data can be viewed simultaneously.

A system for aggregating and disseminating in-case-of-emergency (ICE) medical information to medical units. The system includes an ICE medical record server that stores medical records of respective subscribers, and automatically receive updates from health service entities visited by subscribers. When contacted by emergency dispatchers or first responders, the server sends subscribers medical information to first responders, emergency management agencies directly, via a dispatcher, or via a computer aided dispatch (CAD) system. The medical information may be arranged, emphasized, and/or filtered in a manner relevant to the on-going emergency. A communication device may wirelessly receive the medical information and pre-populate a pre-hospital care form with the information, which may be further orally annotated by the first responder. The completed PCR may then be sent to a PCR server for subsequent access by medical units that subsequently treat the subscriber. The medical server may further assist a public health agency to disseminate emergency information to selected subscribers, responders, and public health alerting systems. An ICE personal server for storing important personal documents is also disclosed. A PCR server is also disclosed that can disseminate aggregate PCR information in near real-time to an emergency management agency (EMA) system for developing incident response plans during a wide area emergency.

A method, system and computer-usable medium are disclosed for the processing of information collected by a mobile device at the site of an incident. An incident information processing system, comprising an incident location information module, receives incident information provided in a communication originated from a mobile device. The received incident information is processed by the incident location information module to provide location information, which is then used to provide incident response services. Image and audio information relating to the incident are likewise provided by the mobile device for processing into incident information. Incident statement questions are generated by the incident information processing system and are then presented via the mobile device for response by various parties associated with the incident. Responses to the questions are collected via the mobile device, processed into incident statements, and stored in the incident information and claims repository.

In various representative aspects, a method and a system that guide an incident response team to efficiently respond to an information security incident based on a roadmap are disclosed herein. A delegated incident response lead may oversee the whole process, including the creation of the roadmap, the performance of the team members, and the statuses of all tasks. When an incident occurs, incident response team members are notified, and delegated tasks in the roadmap are laid out. With a secure collaboration platform, the incident response team may work together in a secure, uncompromised environment.

The invention discloses an automatic testing method, device, equipment and system and belongs to the technical field of computers. The method comprises the following steps: implementing an automated script to test a test case; in the implementing process of the automated script, collecting the performance data of the test case and/or a mobile terminal, and obtaining a performance test report form of the test case according to the performance data. As the method collects the performance data of the test case and/or the mobile terminal and obtains the performance test report form of the test case according to the performance data in the implementing process of the automated script, the method solves the problem that in the prior art, a test of an application program is only a basic incident response test and the performance quality of the application program cannot be fully ensured, and achieves the effects of automatically collecting and analyzing the performance data in the test phase of the application program, reducing the labor cost, and fully ensuring the performance quality of the application program.

An incident commander computing device dynamically reconfigures subscriber unit usage of radio access networks by first identifying, based at least on a type of incident occurring within a particular geographic area, a first incident response group having a first higher priority for responding to the incident and a second incident response group having a second lower priority for responding to the incident, then identifying a first higher priority radio access network having a sufficient coverage level across the particular geographic area and a second lower priority radio access network having a sufficient coverage level across the particular geographic area, and finally assigning the first incident response group to the first higher priority radio access network and assigning the second incident response group to the second lower priority radio access network.

A system for conducting simulations of disaster and hazardous incident responses to assist in the organization, planning, and testing of the response of healthcare and other institutions to such incidents. A series of modules are used to enter personnel resource information into the system, design and create disaster and hazardous incident scenarios, assign personnel to incident command system (ICS) roles, and conduct a simulation with said personnel taking appropriate responsive actions. Personnel may interface with the system through a program creating a dashboard interface. Personnel can access an ICS organization chart, and use it to initiate messages and communications, conduct meetings, take actions, and assign subordinate positions. Personnel can view the status of the response actions in real-time. Standard and custom reports can be created and viewed. The system also can be used to respond to a real incident using the same interface and methods practiced in the simulation.

A computer-implemented incident response management system, and corresponding method in which an incident response application is provided having a user interface; at least one central processing unit; an operating system and a database communicably coupled to said incident response application. The incident response application is configured to: receive, via said user interface, notification of a cyber or information security incident, together with data objects representative of entities related to said incident, files and/or data found during said incident, and/or observed actions and/or outcomes related to said incident; provide, via said user interface, an interactive representation of said incident, including information represented by said data objects, to selected users; receive, in the form of one or more Indicators of Compromise, data related to the detection of system compromise in connection with one or more of said data objects; and store said Indicators of Compromise in connection with a respective incident.

A device and system for use in the early stages of search and recovery after a disaster. The device incorporates a GPS and a radio with very simplified, pre-programmed instructions which are uploaded automatically in the device's memory via wireless technology prior to the unit's first use at a disaster site. Maps of areas to be searched are uploaded into the device and the areas covered during the search are retained in the devices' memory. A unique feature enables the searcher to quickly indicate a specific need or service at a particular location during the search. Via wireless technology Areas that have been searched during a day are downloaded to a base unit and areas to be searched the following day are uploaded to the portable units at the beginning of the day. Radios on the units enable the searchers to audibly communicate with each other. The system can be employed by cleanup teams, insurance adjusters also and any number of post incident response teams both focused on short and long term recovery operations.

The disclosure provides systems and methods for generating and delivering situational-dependent incident responses. An incident response is generated based on incident characterizations as well as emotional data pertaining to a reporting person. The generated response may also involve an interactive component in order to obtain further situational details from the reporting person and other sources, thereby further refine the response and recommendations. Persons reporting incidents are aided by appropriate recommendations and assistance from appropriate service providers.

An automated emergency response method and system to remotely and timely update emergency response protocols, such as Emergency Medical Dispatch Protocol Reference Systems (EMDPRS), is provided. A method and system to remotely and timely update the EMDPRS in a controlled, consistent and timely manner is also provided. A method that can provide accurate, up-to-date and consistent EMDPRS provides the advantage of increasing operator readiness and efficiency in responding to an emergency, and increases the chances of success in dealing with the emergency.

Methods, systems, and computer-readable media for critical incident response training are disclosed. A method of prompting a user of a computing device to choose how a user avatar should interact with a three-dimensional virtual environment in response to a critical incident includes displaying the three-dimensional virtual environment on a display device. The three-dimensional virtual environment graphically represents a physical environment. The method further includes displaying the user avatar that represents the user on a display device. The user avatar is positioned in the three-dimensional virtual environment. The method further includes simulating the critical incident in the three-dimensional virtual environment, and prompting the user to choose how the user avatar should interact with the three-dimensional virtual environment in response to the simulated critical incident.

Various systems and method for incident response may benefit from role-based control. More particularly, role-based control of incident response may be of benefit in a secure collaborative environment. A method can include determining, by a computer for a computer-controlled workflow, whether filtering is activated. The method can also include determining, by the computer when filtering is activated, whether a threshold severity level is met by the workflow or whether a critical data type is implemented in the workflow. The method can further include alerting, by the computer, an attorney about the workflow when the threshold is met or the critical data type is implemented.