CRIE cheat sheet

NIST SP 800-61 lifecycle: Preparation; Detection and Analysis; Containment, Eradication, and Recovery; Post-Incident Activity.

SANS six-phase model: Preparation; Identification; Containment; Eradication; Recovery; Lessons Learned.

An event is any observable occurrence; an incident is an event that actually or potentially jeopardizes confidentiality, integrity, or availability.

Incident severity is typically scored on functional impact, information impact, and recoverability effort, not on attacker intent alone.

CSIRT roles separate incident commander, technical lead, communications lead, and liaison to preserve span of control.

A framework is a governance scaffold (e.g., NIST, ISO/IEC 27035); a playbook is a procedure for one incident type.

ISO/IEC 27035 organizes IR into plan-and-prepare, detect-and-report, assess-and-decide, respond, and learn.

Mean time to detect (MTTD) plus mean time to respond (MTTR) bounds the exposure window of a compromise.

A plan is testable only if it names roles, contact paths, decision authorities, and escalation triggers before an incident occurs.

Tabletop exercises validate decision-making and communication; functional exercises validate tooling and technical procedures.

Out-of-band communication channels are required because the primary email or chat may be compromised or unavailable.

Asset inventories and network diagrams are prerequisites for scoping; unknown assets extend containment time.

Jump bag contents typically include forensic workstations, write blockers, imaging media, and clean credentials.

Pre-approved emergency change authority shortens containment time by removing routine approval delays.

Retainer agreements with IR firms and legal counsel should be executed during preparation, not during an incident.

Log retention must exceed the expected dwell time; short retention destroys the evidence needed for scoping.

Detection sources include EDR telemetry, SIEM correlation, IDS/IPS alerts, netflow, authentication logs, and user reports.

Triage questions: is this a true positive, what is the scope, what is the business impact, and who must be notified.

Indicators of compromise are host or network artifacts (hashes, domains, IPs); indicators of attack are behaviors and intent.

Pyramid of Pain ranks indicators by attacker cost to change: hashes weakest, TTPs strongest.

Alert fidelity is measured by false positive rate; high-volume low-fidelity alerts cause analyst fatigue and missed detections.

Timeline reconstruction correlates host, network, and identity logs on a common normalized clock (UTC recommended).

A confirmed incident requires validation against evidence; a single alert is a lead, not a finding.

Scope determination expands from the initial patient zero outward via shared credentials, lateral paths, and common tooling.

Containment strategy choice: isolation (network segmentation) versus shutdown; shutdown destroys volatile memory evidence.

Short-term containment stops spread; long-term containment stabilizes the environment to allow eradication and recovery.

Eradication removes the root cause (malware, persistence, vulnerable service, compromised account), not just the symptom.

Recovery requires validation criteria: clean scans, restored integrity, monitored stability period, and business sign-off.

Order of volatility (RFC 3227): registers/cache, memory, network state, disk, remote logs, archival media.

Reimaging is preferred over cleaning when persistence mechanism is unknown or rootkit-level compromise is suspected.

Credential rotation for all accounts touched by an attacker is a containment and eradication step, not a recovery step.

Recovery from backups requires verifying backup integrity and that the backup predates the compromise.

Chain of custody records who handled evidence, when, where, and why; any gap weakens admissibility.

Write blockers prevent modification of source media during acquisition; hashing (SHA-256) verifies integrity.

Forensic image is a bit-for-bit copy; a logical copy captures only files and loses slack space and deleted data.

Order of volatility guides acquisition sequence; memory capture precedes power-down when feasible.

Volatile artifacts include running processes, network connections, logged-on users, and RAM-resident malware.

File system timestamps (MACB) can be altered by attacker timestomping; corroborate with other artifacts.

Windows artifacts for timeline: event logs, prefetch, shimcache, Amcache, USN journal, and registry hives.

Analysis must separate observation from inference; findings cite specific artifacts, not assumptions.

Communication plan defines who is informed, by whom, through which channel, and at what cadence.

Need-to-know limits distribution of incident details to reduce leak risk and preserve investigation integrity.

Regulatory notification clocks vary by jurisdiction and data type; legal counsel determines obligations.

Status updates should state confirmed facts, current actions, and next update time; speculation is labeled as such.

Executive reporting emphasizes business impact, risk exposure, and decisions required, not technical minutiae.

Law enforcement engagement is a business and legal decision; preserve evidence regardless of the choice.

Single source of truth (incident log or ticket) prevents conflicting narratives across teams.

External communications (customers, press) are coordinated with legal and communications leads before release.

Lessons learned is held within days of recovery while participant memory is fresh; NIST recommends a post-incident meeting.

A post-incident report documents timeline, root cause, impact, response effectiveness, and corrective actions.

Corrective actions require owners and due dates; otherwise the lessons-learned meeting produces no risk reduction.

Metrics for improvement include MTTD, MTTR, containment time, and count of recurring incident types.

Root cause analysis distinguishes proximate trigger from underlying control failure.

Detection gaps identified post-incident should feed back into use cases, alert tuning, and log coverage.

Recurring incidents of the same type indicate the corrective action was not implemented or not effective.

Evidence retention policy determines how long case artifacts are kept after closure for legal or training use.