Security Operation Center Incident Response Workflow

Incident Responder creates a ticket for reported security events.

Ticket status: "To Do."

Start or In Review:

If the incident is confirmed, change the ticket status to "In Progress."

If further analysis is required, change the ticket status to "Pending Review."

Pending Review:

If approved, change the ticket status back to "In Progress."

If not approved, mark the ticket as Pending.

The ticket may be marked as resolved if the review is satisfactory.

Else the ticket is resolved and DONE.

Reopened:

If flagged for an error, the ticket goes back to "In Progress."

(send an internal message to the reporter so that they can correct the oversight).