Incident Detection and Response
Core ideas
Incident response follows a lifecycle: preparation, detection and analysis, containment, eradication, recovery, and lessons learned. Memorize the order, because questions test sequencing. Containment stops spread; eradication removes the cause; recovery restores normal operations.
Detection sources
Understand logs and monitoring: SIEM correlates events, IDS/IPS alerts on traffic, EDR watches endpoints. Indicators of compromise (IOCs) include unusual outbound traffic, unexpected account changes, and abnormal login times. Indicators of attack (IOAs) focus on behavior rather than artifacts.
Handling and communication
Preserving evidence matters: maintain chain of custody for forensic artifacts. Escalation paths and communication plans are part of preparation. Understand the difference between an event, an alert, and an incident: not every alert is an incident.
Traps in questions
The most common trap is choosing eradication before containment. In most scenarios, contain first to stop the spread, then eradicate. Another trap is deleting evidence or rebooting a compromised host before capturing volatile data. Also watch for questions that ask for the first step in the lifecycle (preparation) versus the first step after detection (analysis/validation).
Worked example
A server is spreading ransomware across a subnet. Correct order: contain (isolate the server and affected hosts from the network), then analyze scope, then eradicate (remove malware, patch the entry point), then recover from clean backups, then conduct lessons learned. Jumping straight to restoring backups without containment lets the infection continue.
Rule of thumb
Contain before you eradicate, eradicate before you recover, and always preserve evidence before making changes.