JP2018174444A - Incident notification device and incident notification program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a device or a program for notifying a person involved in computer network monitoring, automatically of occurrence of an incident.SOLUTION: An incident notification device (10) for notifying of occurrence of incident when the incident is detected in a computer network (14) has an abnormality level database (54) for storing a discrimination reference of the abnormality level of incident, a notification destination database (72) for registering the identification number (76) assigned to a predetermined telephone terminal (42) becoming the notification destination of incident, a discrimination section (52) for discriminating the abnormality level of an incident detected on the basis of discrimination references of abnormality level (58, 60) and notifying of occurrence of an incident, and a call control section (66) for receiving the identification number (76) of a telephone terminal determined as the notification destination from the notification destination database (72), and calling the telephone terminal (42) to which the identification number is assigned.SELECTED DRAWING: Figure 2

Description

  The present invention relates to an incident notification device and an incident notification program, and more specifically to an incident notification device and an incident notification program for notifying an incident detected in a computer network.

  In modern society, computer networks, especially the Internet, have become an indispensable social infrastructure. Along with this, the threat of cyber attacks (cyber terrorism) such as unauthorized access to computer systems of corporations, organizations and individuals through computer networks and theft, tampering or destruction of data is increasing.

  As such threats increase, companies are taking measures. For example, various countermeasure systems are provided at the boundary between an external computer network such as the Internet and an internal computer network to prevent a cyber attack and unauthorized access to the internal computer network by a malicious person. Specific examples of the countermeasure system include a firewall that blocks communication that is determined to be illegal according to a certain standard, and a sandbox that operates a program received from outside in a protected area.

  In addition, companies and others may have established a Security Operation Center (SOC) that monitors the operation status of countermeasure systems in order to strengthen the monitoring system against cyber attacks. In the SOC, when a monitor constantly displays a monitor screen that displays a log related to the operation status of the countermeasure system, an event that threatens the security of the internal computer network, that is, when an incident is detected or an abnormality occurs in the internal computer network To be able to deal with it immediately. In this way, SOC always monitors the safety of the internal computer network for exactly 24 hours a day, 365 days a year.

JP 2003-110723 A

  As described above, in SOC, a supervisor is stationed and monitors whether there is an abnormality. However, when an abnormality occurs, quick judgment and response as an SOC can be made, such as shutting down the network, isolating computers, and contacting management. Needed. For this reason, security engineers and supervisors must always be able to monitor the monitor screen. For this reason, problems such as a shortage of human resources involved in network monitoring and rising labor costs have arisen. Although there exists a technique related to a monitoring system that uses an SOC or a similar base as in Patent Document 1 or the like, none of the techniques can solve the problem.

  By the way, when an abnormality occurs, it is possible to take a means of notifying the security engineer or the supervisor in charge by e-mail. However, when an abnormality occurs due to a cyber attack in particular, a quick response is required even for one second. For this reason, although notification of abnormalities by e-mail can be said to be the best measure in the absence of the person in charge, there is a possibility that a fatal time loss may occur as a countermeasure against a cyber attack competing for a moment.

  SUMMARY OF THE INVENTION The present invention has been made in view of the above problems, and an object of the present invention is to provide an incident notification apparatus or program for automatically notifying occurrence of an incident to a person who is involved in computer network monitoring.

  In order to solve the above-described problem, the incident notification device according to the present invention registers an abnormal level database that stores criteria for determining an abnormal level of an incident, and an identification number assigned to a predetermined telephone terminal that is an incident notification destination. A notification destination database, a determination unit that determines an abnormality level of an incident detected based on an abnormality level determination criterion, determines a telephone terminal that notifies the occurrence of an incident, and a telephone terminal that is determined as a notification destination by the determination unit And a call control unit for making a call to the telephone terminal to which the received identification number is assigned.

  In addition, the incident notification program according to the present invention includes a computer, an abnormality level database that stores a criterion for determining an abnormality level of an incident, a notification destination database that registers an identification number assigned to a predetermined telephone terminal that is an incident notification destination, Determines the abnormal level of the incident detected based on the abnormal level determination criteria, determines the telephone terminal that notifies the occurrence of the incident, and notifies the identification number of the telephone terminal determined as the notification destination by the determining means It is made to function as call control means for making a call to a telephone terminal that is received from the destination database and assigned the identification number received.

  According to the present invention, even if a person who should respond to an incident is not resident in the SOC, the occurrence of the incident is automatically notified to a person who is in charge of monitoring the computer network according to the content of the detected incident. There is a unique effect of being able to.

1 is a schematic diagram showing a configuration of a computer network using an embodiment of an incident notification device according to the present invention. 1 is a schematic diagram illustrating a configuration of an embodiment of an incident notification device according to the present invention. It is a figure which shows an example of the notification operation | movement performed using the Example of this invention as a flowchart. It is a figure which shows roughly the structure when operating a computer as an Example of this invention.

  Next, an embodiment of an incident notification device according to the present invention will be described in detail with reference to the accompanying drawings. Referring to FIG. 1, an embodiment of an incident notification device 10 according to the present invention is installed as a component device of an internal computer network 14 connected to an external computer network 12 such as the Internet. When the incident notification device 10 according to the present embodiment detects an incident that threatens the security of the internal computer network 14 in accordance with monitoring of a cyber attack, the incident notification device 10 performs an operation of notifying the user of the detection. The external computer network 12 and the internal computer network 14 are connected by a communication line 16.

  A countermeasure system group 18 for preventing unauthorized access and cyber attacks from the external computer network 12 by various methods is provided inside the internal computer network 14, particularly at the boundary between the external computer network 12 and the internal computer network 14.

  Since there are various methods of unauthorized access and cyber attacks, the countermeasure system group 18 provided in the network 14 is usually composed of various types of countermeasure systems 20-30. Each of the countermeasure systems 20 to 30 constituting the countermeasure system group 18 is software that tends to be easy to install even if it is an actual device or hardware that generally tends to be superior in defense performance. It doesn't matter. In addition, hardware and software may be properly used for each countermeasure system.

  As an example of the countermeasure system that constitutes the countermeasure system group 18, it is provided at the boundary between the external computer network 12 and the internal computer network 14, and communications that attempt to pass through this boundary can be monitored and determined to be illegal according to a certain standard. One example is a firewall 20 that blocks communication.

  In addition, as another example of the countermeasure system that constitutes the countermeasure system group 18, an intrusion detection system (IDS) that detects the presence of unauthorized communication and reports it to the supervisor or detects the presence of unauthorized communication An intrusion prevention system (IPS) that blocks the communication when it is done. As shown in FIG. 1, the system is often systematized as IDS / IPS 22 having both an intrusion detection function and a defense function. According to IDS / IPS 22, it is possible to protect the internal computer network 14 against unauthorized communication that does not meet certain standards and has passed through the firewall 20.

  Still another example of the countermeasure system that constitutes the countermeasure system group 18 is mail security 24 that protects the internal computer network 14 from cyber attacks via electronic mail. E-mail security 24 prevents cyber-attacks that use e-mail, such as detecting and removing e-mail infected with viruses or e-mail that leads to a so-called phishing site that impersonates another person and steals personal information. Is possible.

  Yet another example of a countermeasure system that constitutes the countermeasure system group 18 is a web filter 26 that restricts connection to a web site that may be harmful to the company or the network 14 within the company. . Examples of websites whose connection is restricted by the web filter 26 include websites that are infected by a virus just by browsing, websites that may be accessed for the purpose of information leakage, and the like.

  As still another example of the countermeasure system constituting the countermeasure system group 18, there is a sandbox 28 that prevents an adverse effect from being exerted outside the area by operating the program received from outside only in the protected area. According to the sandbox 28, even if a program received from the external computer network 12 is malicious, it protects programs and data outside a predetermined virtual environment isolated from other parts of the computer. be able to.

  As another example of the countermeasure system that constitutes the countermeasure system group 18, these terminal devices are protected from cyber attacks by being mounted on a terminal such as a server, personal computer, or smartphone connected to the end of the internal computer network 14. And endpoint security 30.

  The internal computer network 14 includes an incident management device 32 that monitors and analyzes incidents detected by the countermeasure system group 18. Each countermeasure system 20-30 of the countermeasure system group 18 is connected to the incident management device 32 via the communication line 34. When an incident that may threaten the security of the network 14 is detected, a log related to the incident is sent to the communication line 34. Output. When the incident management apparatus 32 receives the log related to the incident via the communication line 34, the incident management apparatus 32 independently aggregates the received logs, and monitors and analyzes the collected logs. In FIG. 1, for convenience of illustration, the communication line 34 is collectively shown as a line connecting the countermeasure system group 18 and the incident management apparatus 32, but each of the countermeasure systems 20 to 30 and the incident management apparatus 32 are individually connected. It may be configured.

  As described above, companies that have built the internal computer network 14 generally have a security operation center (SOC) that monitors whether the network 14 is exposed to a cyber attack. The SOC may be one that is constructed and operated by a company or the like, or one that is outsourced to use an external service.

  The internal computer network 14 and the SOC are communicably connected via a communication line 36. More specifically, the internal computer network 14 is connected via a communication line 36 to a monitoring monitor 38 that is installed in the SOC and displays a log analysis status by the incident management device 32.

  The monitor who is present in the SOC constantly monitors the analysis status of the log output and displayed on the monitor monitor 38. If the monitor finds an abnormality to be detected that is detected in the network 14, he / she takes necessary measures. Such a monitoring system by SOC itself is a system that has been implemented conventionally. However, it is possible to strengthen the monitoring system by installing the incident detection apparatus according to the embodiment of the present invention in the internal computer network 14 while continuing the conventional monitoring system using the SOC.

  In the internal computer network 14, the incident notification device 10 according to the embodiment of the present invention is connected to the incident management device 32 via the communication line 40. With this connection configuration, the incident notification device 10 can receive information related to the abnormality detection log detected by the countermeasure system group 18 and information related to the result of the incident management device 32 analyzing the monitoring status of the countermeasure system group 18. Become.

  Based on the information received from the incident management device 32, the incident notification device 10 determines how much abnormal level the incident detected by the countermeasure system group 18 is.

  The incident notification device 10 is connected to a plurality of telephone terminals 42a to 42c via respective lines 44a to 44c. A unique telephone number is set for each of the telephone terminals 42a to 42c. Each telephone terminal 42 may be a fixed phone or a mobile phone, or a fixed phone and a mobile phone may be used for each terminal. The line 44 may be a wired line or a wireless line.

  In the case of the present embodiment, it is assumed that each of the plurality of telephone terminals 42a to 42c has a user determined by an agreement between persons engaged in monitoring of the internal computer network 14, that is, SOC workers. In the example of FIG. 1, the telephone terminal 42a is for the supervisor of the entire SOC or the entire network 14, the telephone terminal 42b is for the supervisor who is supervised by the supervisor and supervises the monitoring department of the SOC, and the telephone terminal 42c is A terminal for a maintenance person who reports directly to the person in charge of monitoring and is engaged in maintenance work of the network 14.

  The incident notification device 10 determines to which telephone terminal 42 the call is to be made based on the determined abnormal level of the incident and the type of abnormality. Based on the determination result, the incident notification device 10 further calls one or more of the telephone terminals 42a to 42c.

  Next, a configuration example of the incident notification device 10 will be described in more detail with reference to FIG. The incident notification device 10 is connected to the incident management device 32 via the communication line 40, and based on the information related to the incident received from the management device 32, a determination unit 52 that determines the level of abnormality of the incident. Have

  Furthermore, the incident notification device 10 has an abnormality level database 54 that stores data related to the abnormality levels of incidents set in advance in a plurality of stages according to the contents of the abnormality detection log. The abnormal level database 54 is connected to the determination unit 52 via the communication line 56, and the determination unit 52 can determine the abnormal level by receiving data from the database 54.

  At the abnormal level stage, there is an “emergency situation” with a “warning level” that requires a highly urgent action depending on whether or not a specific attack has started and the severity of damage expected. The “attention level” is prepared by classifying it as “information level” that does not require any action at the present time but is stored as future reference information.

  The abnormality level database 54 stores a determination program 58 that defines a procedure for determining the abnormality level of the abnormality detection log. When the discriminator 52 receives supply of information related to the anomaly detection log from the incident management device 32, according to the procedure stipulated in the discriminant program 58 read from the database 54, the detected incident corresponds to what anomaly level Is determined.

  The abnormality level database 54 preferably stores data relating to abnormality detection logs for known computer viruses and data relating to abnormality detection logs detected by the countermeasure system group 18 classified for each abnormality level. For example, the warning level data 60a, the attention level data 60b, and the information level data 60c may be classified and stored. If such data can be used in the abnormal level determination step, the determination of the abnormal level by the determination unit 52 can be made more quickly and accurately. In other words, the determination program 58 and the data 60a to 60c relating to the abnormal level can be used as the determination criteria for the abnormal level of the detected incident.

  The determining unit 52 further determines whether or not there is a need to make a call to each of the telephone terminals 42a to 42c based on the determination result of the abnormal level. It is possible to determine which telephone terminal 42 is to be called based on only the abnormal level that is simply determined. In addition to the abnormal level, another determination factor is added to the situation even if the abnormal level is the same. Accordingly, the call destination of the telephone terminal 42 may be changed. The number of the telephone terminals 42 as call destinations is not limited to one, and the determination unit 52 may select a plurality of telephone terminals 42 as simultaneous call destinations. Note that the determination unit 52 can also determine a voice message to be played when a call of a telephone terminal to be called is established based on the determined abnormal level, call destination, incident characteristics, and the like.

  The incident notification device 10 is connected to the telephone terminals 42a to 42c via the lines 44a to 44c, and has a call control unit 66 that controls a calling operation for the telephone terminal 42. The call control unit 66 is, for example, a VoIP (Voice over Internet Protocol) control unit 66 that performs a control operation necessary for performing voice communication through a TCP / IP (Transmission Control Protocol / Internet Protocol) network that is a standard communication protocol of the Internet. It is. When the call control unit 66 is a VoIP control unit, the VoIP control unit is equipped with a VoIP server, and it is possible to realize an Internet telephone in accordance with a session establishment protocol (SIP).

  The call control unit 66 is connected to the determination unit 52 via the communication line 68, and the determination unit 52 transmits the call notification call instruction determined by itself to the call control unit 66, and the call control unit 66 receives the instruction. can do.

  The incident notification device 10 has a notification destination database 72 in which telephone numbers previously assigned to telephone terminals 42a to 42c or similar identification numbers are registered, and the notification destination database 72 performs call control via a communication line 74. Connected to section 66. When the call control unit 66 receives the call instruction from the determination unit 52, the call control unit 66 reads the telephone numbers 76a to 76c of the telephone terminals 42a to 42c instructed as the call destination from the notification destination database 72. Next, the call control unit 66 calls the telephone terminals 42a to 42c instructed by the determination unit 52 based on the read telephone numbers 76a to 76c.

  In general, the telephone terminal 42 is directly or indirectly connected to various types of telephone networks and communication networks, and there is a possibility of receiving calls from an unspecified number of people. Further, even when an incoming call is received from the incident notification device 10, the circumstances that led to the notification device 10 performing a calling operation are different every time, and therefore the requirements to be notified are usually different. For this reason, the user of the telephone terminal 42 usually needs to operate the terminal to establish a call when the terminal 42 receives an incoming call, and hear the message from the person who made the call. Therefore, the incident notification device 10 has a voice database 78 that stores a voice message to be transmitted to the telephone terminal 42 to which the call is established when a call from the call control unit 66 to the telephone terminals 42a to 42c is established. It is preferable.

  The voice database 78 is connected to the call control unit 66 via the communication line 80. Further, the voice database preferably stores a plurality of types of voice messages 82a to 82c according to the call destination and matters to be notified.

  In the description and reference drawings regarding the present embodiment, the abnormality level database 54, the notification destination database 72, and the voice database 78 are described as separate components. However, this description and illustration is conceptual. Therefore, a single storage unit is provided in the incident notification device 10, and an area for storing data 58 and 60 relating to an abnormal level discrimination criterion, an area for storing notification destination data 76, and a voice message 82 are stored in the storage unit. The storage unit may be divided into areas, and the storage unit may correspond to an aggregate of the databases 54, 72, and 78.

  When a call from the call control unit 66 to the telephone terminals 42a to 42c is established, the call control unit 66 selects one message from the voice messages 82a to 82c stored in the voice database 78, and the call is received. The selected voice message is automatically transmitted or reproduced to the established telephone terminal 42. When a plurality of types of voice messages 82 are stored, selection of a voice message to be transmitted to a predetermined terminal 42 may be based on an instruction determined by the determination unit 52 and issued to the call control unit 66.

  Also, a plurality of types of partial voice messages are stored in the voice database 78, selected as appropriate according to the abnormal level, notification destination, incident characteristics, etc., and a plurality of voice messages are combined to make a complete voice message. It may be transmitted to the terminal 42. In this case, the discriminating unit 52 determines the combination of voice messages to be reproduced and sends an instruction to the call control unit 66.

  With this configuration, when communication between the incident notification device 10 and the telephone terminals 42a to 42c is established, the user of the terminal in communication listens to a voice message as guidance that flows, and any incident occurs in the internal computer network 14. You can be notified of the occurrence.

  For example, if the person in charge of the incident is notified by the general manager using the telephone terminal 42a or the supervisor in charge of using the telephone terminal 42b, these managers use these managers. The telephone terminal 42c that is present can be called and a specific action can be instructed.

  In addition, if the incident is a specific action to be dealt with in advance, and the judgment of the person responsible for implementing such action is not necessary, the incident notification device 10 can be used by an actual worker or maintenance person. A call may be made only to the telephone terminal 42c to be used. The incident notification device 10 directly notifies the maintenance person of the incident, so that the maintenance person who has received the communication can quickly deal with the incident.

  By the way, cyber attack methods are evolving day by day. Therefore, it is necessary to continuously update the abnormality level determination conditions by the incident notification device 10 and the calling conditions to each telephone terminal 42. Therefore, the monitoring person monitoring the log analysis status by the incident management device 32 from the monitoring monitor 38 in the SOC should access the abnormal level database 54 and update the determination condition and the calling condition as appropriate. Is preferred. By updating the conditions in this way, it is possible to upgrade the incident notification device 10.

  By using the incident notification device 10 having the above-described configuration, it is possible to quickly determine the seriousness of an incident that has occurred and automatically contact a person in charge according to the content of the abnormality. In addition, if the incident notification device 10 is used, even if the person responsible for responding to an abnormality does not reside in the SOC, the person responsible who has received the notification determines the action policy in real time and maintains the SOC even from a remote location. The countermeasures can be instructed to the person etc.

  Next, an operation example of the incident notification apparatus 10 according to the present invention and the computer network 14 including the apparatus 10 will be described. When the countermeasure system group 18 monitors the internal computer network 14 and detects an incident that may be abnormal, it outputs a log relating to the incident to the incident management device 32 as an abnormal log (preliminary step PS10). The incident management apparatus 32 autonomously aggregates the abnormality logs received from the countermeasure system group 18, and continuously monitors and analyzes the collected logs (preliminary step PS20).

  The incident management device 32 outputs the monitoring and analysis results to the incident notification device 10. That is, from the viewpoint of the notification device 10 according to the embodiment of the present invention, the result of monitoring and analysis by the incident management device 32 is received (step S10).

  The determination unit 52 of the incident notification device 10 determines the abnormal level of the detected log based on the determination program 58 and the data 60a to 60c stored in the abnormal level database 54 (step S20). Based on the determination result, the determination unit 52 determines whether to make a call to the telephone terminals 42a to 42c, to which terminal to make a call, and the content of the voice message to be sent after the call is established. (Step S30). If the determination unit 52 determines not to make a call, the determination unit 52 continues to perform the monitoring / analysis result determination process (step S20) successively output from the incident management device 32.

  When the determination unit 52 determines to make a call to the predetermined telephone terminal 42, the determination unit 52 transmits a call instruction for the predetermined telephone terminal 42 to the call control unit 66 (step S40). Upon receiving the call instruction, the call control unit 66 makes a call to the telephone number 76 stored in the notification destination database 72, which is unique to the telephone terminal 42 determined by the determination unit 52 to make a call in step S40. A call is executed (step S50).

  When a call from the call control unit 66 to the telephone terminals 42a to 42c is established, the call control unit 66 follows the selection decision of the determination unit 52 in step S40, and the voice messages 82a to 82c stored in the voice database 78 are stored. Either one is automatically transmitted (step S60).

  The user who has heard the voice message 82 through the telephone terminal 42 takes a predetermined action according to the content of the message. For example, if the supervisor or supervisor receives a voice message, determine the response policy according to the content of the incident, call the maintenance personnel engaged in the duties within the SOC, Send instructions. On the other hand, if the voice message was received by a maintenance worker engaged in duties within the SOC, the countermeasures that were determined in advance according to the content of the incident were executed without waiting for the responsible person's judgment. To do.

  By realizing such an operation in the embodiment of the incident notification device 10 according to the present invention, it is possible to shorten the time from when an abnormality occurs in the internal computer network 14 until a countermeasure is taken. Such a time reduction is extremely effective as an anti-virus measure for 1 second. As a result, companies can reduce the risk of damage.

  By the way, the embodiment of the present invention described above can also be realized by installing a program for causing a computer to perform the role as the incident notification device 10 to a predetermined computer. An embodiment in this case will be briefly described with reference to FIG.

  A program that causes the computer 110 to function as an embodiment of the incident notification device 10 according to the present invention is stored in the storage medium 112. Here, the storage medium 112 includes any device or component capable of storing a program, such as an optical disk, a magnetic disk, or a flash memory.

  The computer 110 has a drive 114 that can read the storage contents of the storage medium 112. The drive 114 may be fixedly incorporated in the computer 110, or may be an external device that can be connected to the computer 110 independent of the casing of the computer 110. The computer 110 also includes a central processing unit (CPU) 116 that performs information processing such as computation and control of the computer itself, and a storage device 118 that stores programs, data, and the like. For convenience, the storage device 118 shown in this figure includes both a device that temporarily stores data and a device that constantly stores data. The CPU 116 is connected to the drive 114 via the connection line 120, and is also connected to the storage device 118 via the connection line 122.

  The program stored in the storage medium 112 is read by the computer 110 via the drive 114, and the read program is stored in the storage device 118 of the computer 110 under the control of the CPU 116. The computer 110 in which the program is incorporated in this way can work as the voice display device 10 by executing the program. According to the contents of the program, this program causes the CPU 116 in the computer 110 to function as each processing means and each control means that operate in cooperation with the discrimination means 52 and the discrimination means 52. It can also be said that it works as 72 and 78. Various other devices in the computer 110 (not shown) also function as components of the voice display device 10 by executing the program.

  Note that program installation or program update to the computer 110 is not limited to a method of reading a program stored in the storage medium 112 via the drive 114, but a method of reading the program by communication via the external computer network 12, etc. May be adopted.

  Although several embodiments of the present invention have been described so far, specific methods for implementing the present invention are not limited to the above-described embodiments. As long as the present invention can be implemented, the design, operation procedure, and the like can be changed as appropriate. For example, a device or a circuit whose main purpose is to assist the function of the components used in the present invention can be appropriately added and omitted.

10 Incident notification device
14 Internal computer network
42 Telephone terminal
52 Discriminator
54 Abnormal level database
66 Call controller
72 Notification database
78 Voice database
110 computers

Claims (6)

In an incident notification device for notifying the occurrence of an incident when an incident is detected in a computer network,
An abnormal level database for storing criteria for determining the abnormal level of the incident;
A notification destination database for registering an identification number assigned to a predetermined telephone terminal as a notification destination of the incident;
A determination unit that determines an abnormal level of the detected incident based on a determination criterion of the abnormal level, and determines a telephone terminal that notifies the occurrence of the incident;
A call control unit that receives the identification number of the telephone terminal determined as the notification destination by the determination unit from the notification destination database and makes a call to the telephone terminal to which the received identification number is assigned. Incident notification device. The incident notification device according to claim 1, further comprising a voice database that stores a voice message for notifying the occurrence of the incident by voice,
The determination unit determines a voice message to be sent to the telephone terminal serving as the notification destination based on at least one of the determined abnormality level, the notification destination of the incident, and the characteristics of the incident,
The incident control device, wherein the call control unit transmits a voice message determined by the determination unit when a call from the incident notification device to the telephone terminal is established.   3. The incident notification device according to claim 1, wherein the call control unit is a VoIP (Voice over Internet Protocol) control unit that implements a voice call using an Internet protocol network. In an incident notification program for causing a computer to function as an incident notification device for notifying the occurrence of an incident when an incident is detected in a computer network,
An abnormal level database that stores criteria for determining the abnormal level of the incident,
A notification destination database for registering an identification number assigned to a predetermined telephone terminal as a notification destination of the incident;
Determining means for determining an abnormal level of the detected incident based on a determination criterion of the abnormal level, and determining a telephone terminal for notifying the occurrence of the incident; and
Receiving the identification number of the telephone terminal determined as the notification destination by the determination means from the notification destination database and functioning as a call control means for making a call to the telephone terminal to which the received identification number is assigned. Incident notification program. 5. The incident notification program according to claim 4, wherein the program further causes the computer to function as a voice database storing a voice message for notifying the occurrence of the incident by voice.
The determination means determines a voice message to be sent to the notification destination telephone terminal based on at least one of the determined abnormality level, the incident notification destination, and the incident characteristics,
The call notification means, when a call from the computer to the telephone terminal is established, transmits a voice message determined by the discrimination means. 6. The incident notification program according to claim 4, wherein the program causes the call control means to function as a VoIP (Voice over Internet Protocol) control means for realizing a voice call using an Internet protocol network. Incident notification program.

Images