2 better conclusion
source | link

That depends. Is the incident analysis something that has to be investigated, or is it an incident for testing and training purposes only? Is there anything to investigate, or would there be anything to investigate?


incident-analysis

I can cause an incident on my own systems and throw an alarm, but may not know why I threw it in my IDS. At that point I should analyze the incident, but no investigation into scope and breach of attack may be needed.

investigation

This could mean that you're investigating something security related but isn't an incident. Maybe I want to investigate another system in our network, but I don't have an incident. I just want to make sure it's a safe system and go poking around. I have something I know is related to security, but I don't know what it is, or if it's safe and I should investigate it's purpose further.


Really these are connotations, but show that one could exist without the other. Granted they are usually heavily inter dependent, but cases like these provided are common as well. IT really feels like these tags are poorly defined and need to be updated to be a little more concise. It would be helpful to know that I can have one without the other, but in most actual incident analysis I would want both.

That depends. Is the incident analysis something that has to be investigated, or is it an incident for testing and training purposes only? Is there anything to investigate, or would there be anything to investigate?


incident-analysis

I can cause an incident on my own systems and throw an alarm, but may not know why I threw it in my IDS. At that point I should analyze the incident, but no investigation into scope and breach of attack may be needed.

investigation

This could mean that you're investigating something security related but isn't an incident. Maybe I want to investigate another system in our network, but I don't have an incident. I just want to make sure it's a safe system and go poking around. I have something I know is related to security, but I don't know what it is, or if it's safe and I should investigate it's purpose further.


Really these are connotations, but show that one could exist without the other. Granted they are usually heavily inter dependent, but cases like these provided are common as well.

That depends. Is the incident analysis something that has to be investigated, or is it an incident for testing and training purposes only? Is there anything to investigate, or would there be anything to investigate?


incident-analysis

I can cause an incident on my own systems and throw an alarm, but may not know why I threw it in my IDS. At that point I should analyze the incident, but no investigation into scope and breach of attack may be needed.

investigation

This could mean that you're investigating something security related but isn't an incident. Maybe I want to investigate another system in our network, but I don't have an incident. I just want to make sure it's a safe system and go poking around. I have something I know is related to security, but I don't know what it is, or if it's safe and I should investigate it's purpose further.


Really these are connotations, but show that one could exist without the other. Granted they are usually heavily inter dependent, but cases like these provided are common as well. IT really feels like these tags are poorly defined and need to be updated to be a little more concise. It would be helpful to know that I can have one without the other, but in most actual incident analysis I would want both.

1
source | link

That depends. Is the incident analysis something that has to be investigated, or is it an incident for testing and training purposes only? Is there anything to investigate, or would there be anything to investigate?


incident-analysis

I can cause an incident on my own systems and throw an alarm, but may not know why I threw it in my IDS. At that point I should analyze the incident, but no investigation into scope and breach of attack may be needed.

investigation

This could mean that you're investigating something security related but isn't an incident. Maybe I want to investigate another system in our network, but I don't have an incident. I just want to make sure it's a safe system and go poking around. I have something I know is related to security, but I don't know what it is, or if it's safe and I should investigate it's purpose further.


Really these are connotations, but show that one could exist without the other. Granted they are usually heavily inter dependent, but cases like these provided are common as well.