O cenário
A security operations center needs a database to track incidents from alerts, manage investigation cases, assign analysts, and record affected assets and evidence.
O que há neste desenho
Entenda as decisões por trás dele.
01
Separated Incident and Case entities to allow incidents to be escalated to cases only when necessary
02
Used a many-to-many relationship between Incident and Asset via an IncidentAsset junction table
03
Linked Evidence directly to Case to support chain of custody
Suitable for SOC platforms, SIEM/SOAR systems, or cyber threat intelligence databases.