RBA triage/investigation

[ZachTheSplunker]

Question from "The Office" Hours meetup

Is there any written guidance on how to triage/investigate a risk notable, vs. a traditional notable?

[ZachTheSplunker]

Answer from "The Office" Hours meetup

TLDR: no.
If you don't know where to start, start with the known risk frameworks, such as MITRE.
If you have a well-documented incident response plan, it will instruct your RBA approach.

NOTE: watch for RBA academy announcement in 2023