Dynamic Incident Extraction for Flexible Response Procedures
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing incident response systems are limited in their ability to respond flexibly to various incidents, as they require pre-registered response procedures and lack guidance for manual processes, making them ineffective for unregistered incidents and increasing operational costs and time in identifying incident types and locations within large-scale systems.
Innovation Solution
An incident response assisting device that includes an incident detection information acquisition unit, log data acquisition unit, incident extraction unit, response procedure creation unit, and display unit, which extracts incident information through a series of comparison processes and creates a response procedure based on incident-specific data, allowing for flexible responses to various incidents.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If a manual response process is performed when a response procedure is not registered in the knowledge system, then the system can handle unregistered incidents, but the range of incidents the operation management system can respond to is limited and it cannot respond flexibly to various incidents
Solution Approach 1:
The incident extraction unit automatically extracts incident information from incident detection information and log data through comparison processes, enabling the system to self-identify incident types and locations without requiring pre-registered response procedures for every incident type, thus improving both adaptability and ease of operation
Solution Approach 2:
The system dynamically changes the content of comparison processes based on results of previously performed comparison processes, allowing flexible adaptation to different incident types and scenarios without requiring pre-defined response procedures for each specific incident
2Measurement precision
If sufficient personnel arrangement and education are provided to rapidly and accurately conduct incident response work, then response accuracy improves, but high cost is required
Solution Approach 1:
The incident response assisting device acts as an intermediary between incident detection and response execution, automatically extracting incident information and generating response procedures to guide users, thereby maintaining high response accuracy without requiring extensive personnel training or arrangement
Solution Approach 2:
The system replaces the mechanical approach of training and arranging sufficient personnel with an automated information extraction and procedure generation system that provides accurate incident identification and response guidance at low cost
3Measurement precision
If the incident extraction process uses a series of comparison processes where subsequent comparison content changes based on previous results, then incident identification accuracy improves, but process complexity increases
Solution Approach 1:
The incident extraction process is designed as a dynamic series of comparison processes where the content of subsequent comparisons changes based on results of previous comparisons, allowing the system to adaptively focus on relevant incident characteristics and achieve high identification accuracy while managing complexity through conditional flow
Data Source
AI summary
The incident response assisting device includes: an incident extraction unit, a response procedure creation unit, and a screen display unit. The incident extraction unit performs an incident extraction process on an alert indicating that an incident has occurred in a monitored object and on log data of the monitored object, to extract incident information. The response procedure creation unit creates an incident response procedure corresponding to the incident on the basis of the incident information and a response procedure template. The screen display unit selects a display range from the incident response procedure in accordance with a progress status of response and displays the display range as a display response procedure.The incident extraction process is composed of a series of comparison processes in which a content of a comparison process to be subsequently performed is changed in accordance with a result of a previously performed comparison process.