INFORMATION SECURITY INCIDENT RESPONSE TOOLING ENVIRONMENT

Abstract

The article examines the interaction of an open IRP system developed by the international community with Russian-made firewalls. Based on the functions of the "TheHive" system, the functionality for blocking attacks from the external perimeter is implemented. The algorithm of the module for interaction with firewalls to prevent computer attacks is presented, for the development of which the Python language is used, in particular, the textFSM module. The result is an IRP system with an implemented user response function, which can serve as a technological basis for the work of the Security Center (SOC).