السيناريو
A security operations center needs a database to track incidents from alerts, manage investigation cases, assign analysts, and record affected assets and evidence.
ما الذي يتضمنه هذا الرسم
اقرأ القرارات الكامنة وراءه.
01
Separated Incident and Case entities to allow incidents to be escalated to cases only when necessary
02
Used a many-to-many relationship between Incident and Asset via an IncidentAsset junction table
03
Linked Evidence directly to Case to support chain of custody
Suitable for SOC platforms, SIEM/SOAR systems, or cyber threat intelligence databases.