Threat Detection and Incident Response
What to know
Understand the detection stack: log collection, normalization, correlation, alerting, and tuning. Know data sources - endpoint telemetry, network flows, DNS, authentication logs, cloud audit logs, and application logs - and what each can and cannot reveal. Understand the difference between signature-based and behavior-based detection, and why baselining reduces false positives.
Incident response follows a lifecycle: preparation, detection and analysis, containment, eradication, recovery, and lessons learned. Know the difference between containment strategies (isolate host, block indicator, disable account) and eradication (remove malware, close the vulnerability). Evidence handling requires chain of custody, order of volatility (capture memory and volatile state before disk, disk before archival media), and forensic imaging with hashing.
Understand the roles: incident commander, communications, legal, and executive sponsorship. Know escalation criteria, notification obligations, and the value of tabletop exercises. Metrics such as mean time to detect and mean time to respond guide program maturity.
Traps
Questions often skip containment and jump to eradication, which can destroy evidence or let the attacker persist. Another trap: shutting down a compromised host may erase volatile evidence - isolate the network instead. Beware options that notify external parties before legal and executive review, or that treat log volume as equivalent to detection quality.
Worked example
An analyst finds beaconing traffic from a workstation. The correct first actions are to isolate the host at the network layer, preserve memory and logs, then hunt for the same indicator across the estate - not to immediately reimage the machine.
Rule of thumb: contain first, preserve evidence, then eradicate - and follow the order of volatility.