Tools
In this section, example tool providers will be listed, but the CySA+ exam is vendor-neutral, so you are not expected to know any of these tools in any depth. If any of these tool topic sets require further depth for the test, they will be discussed later in the book.
Tools can be an integral part of the IR process. Tools provide support to all phases of the IR life cycle and support multiple purposes. The overall IR process can be supported with IR platforms and ticketing tools. IR platforms allow for centralized management and automation of some IR processes, such as incident detection and alerting, case management, threat intelligence integration, and workflow automation. Some examples of IR platform tools are Demisto, Resilient, and Phantom. Ticketing tools support these efforts by documenting the incident process as it occurs, from initial detection through lessons learned. Some examples of ticketing tools include BMC Remedy, ServiceNow, and Ivanti. Communication and...
