Detection and Identification
Finding the signal in the noise
Detection converts telemetry into confirmed incidents. You must understand the major detection sources: SIEM correlation, EDR, IDS/IPS, netflow, DNS logs, authentication logs, and user reports. Know the difference between indicators of compromise (IOCs) - hashes, IPs, domains, filenames - and indicators of attack/behavior (IOAs/TTPs) - process injection, credential dumping, lateral movement. IOAs are more resilient because attackers can change IOCs easily.
Concepts to master
- Triage and validation: confirm true positive vs. false positive before escalating; document the decision.
- The Pyramid of Pain: hash < IP < domain < network artifact < tool < TTP; higher levels hurt adversaries more.
- Detection engineering: tuning rules to reduce false positives and alert fatigue.
- Scope determination: after confirming one compromised host, hunt for others using the same TTPs.
- Timeline reconstruction: correlate timestamps across sources (mind time zones and clock skew).
Traps in questions
A frequent trap is treating a single alert as a confirmed incident without validation. Another is confusing detection with prevention - an IPS blocking traffic is prevention; the alert that it would have blocked is detection. Also beware of relying on a single IOC: absence of a known hash does not mean a host is clean.
Rule of thumb
Validate, then scope. Ask "Is this real?" before "How far did it spread?" - but never stop at the first host.