상황
A security operations center needs a database to track incidents from alerts, manage investigation cases, assign analysts, and record affected assets and evidence.
이 도면에 담긴 내용
그 이면의 의사결정을 읽어 보세요.
01
Separated Incident and Case entities to allow incidents to be escalated to cases only when necessary
02
Used a many-to-many relationship between Incident and Asset via an IncidentAsset junction table
03
Linked Evidence directly to Case to support chain of custody
Suitable for SOC platforms, SIEM/SOAR systems, or cyber threat intelligence databases.