6.1 Understanding iTRAC Workflows
Workflows can be built using manual and automated steps. Advanced features such as branching, time-based escalation, and local variables are supported. Integration with external scripts and plug-ins allows for flexible interaction with third-party systems. Comprehensive reporting allows administrators to understand and fine-tune the incident response processes.
NOTE:Access to manage iTRAC templates, activities, and processes can be enabled on a user-by-user basis by any user with the ability to change user permissions.
The iTRAC system uses three Sentinel objects that can be defined outside the iTRAC framework:
Table 6-1 Sentinel Objects Used by iTRAC
|
Incident |
Incidents within Sentinel are groups of events that represent an actionable security incident, plus associated state and meta-information.
Incidents are created manually or through Correlation rules, and can be associated with a workflow process. They can be viewed on the tab. |
|
Activity |
An Activity is a predefined automatic unit of work, with defined inputs, command-driven activity, and outputs (for example, automatically attaching asset data to the incident or sending an e-mail).
Activities can be included in a workflow template and executed during workflow processes, or they can be executed within an incident. |
|
Role |
Sentinel users can be assigned to one or more roles. Manual steps in the workflow processes can be assigned to a role. |
iTRAC Workflows have four major components that are unique to iTRAC:
Table 6-2 Major Components of iTRAC
|
Step |
A step is an individual unit of work within a workflow; there are manual steps, decision steps, command steps, mail steps, and activity-based steps. Each step displays as an icon within a given workflow template. |
|
Transition |
A transition defines how the workflow moves from one state (activity) to another. This can be determined by an analyst action, by the value of a variable, or by the amount of time elapsed. |
|
Templates |
A template is a design for a workflow that controls the flow of execution of a process in iTRAC.
The template consists of a network of manual and automated steps. Activities and criteria for transition between them.
Workflow templates define how an incident is responded to after a process based on that template is instantiated (see below).
A template can be associated with many incidents. |
|
Processes |
A process is a specific instance of a workflow template that is actively being tracked by the workflow system. It includes all the relevant information relating to the instance, including the current step in the workflow, the associated incident, the results of steps, attachments, and notes.
Each workflow process is associated to one and only one incident. |