Security Operations, Monitoring, and Incident Response
What to know cold
Operations is where controls run day to day. Know log sources (endpoint, network, application, identity), SIEM correlation, alert tuning, and the difference between an event, an alert, and an incident. Understand the incident-response lifecycle - preparation, detection and analysis, containment, eradication, recovery, lessons learned - and the role of evidence handling (chain of custody, order of volatility). Know vulnerability management cadence, patch prioritisation by risk, change management, and the value of tabletop exercises. Understand escalation paths and communication with stakeholders.
Traps that show up in questions
- Jumping to eradication before containment; contain first to stop spread.
- Wiping and rebuilding a host before capturing volatile evidence.
- Confusing a vulnerability scan with a penetration test.
- Treating alert volume as success; tuning matters more than count.
- Forgetting lessons learned, which closes the loop and improves preparation.
Rule of thumb
Follow order of volatility: capture memory and network state before disk, and disk before rebuilding. Contain, then eradicate, then recover, then review.
Worked example
Malware is detected on a server. The analyst isolates the host from the network (containment) while preserving a memory image, then identifies the entry point, removes persistence, patches the flaw, restores from a known-good image, monitors for recurrence, and documents lessons learned. Rebuilding first would destroy evidence and may leave the entry point open.