SIRS: Detection and Analysis

This domain tests triage discipline: how you move from a raw signal to a validated, scoped, documented incident without destroying what you will later need.

Precursors, indicators, and their limits

• A precursor signals that an attack may occur - a vulnerability disclosure, a threat-intel warning, a newly published exploit.
• An indicator of compromise (IoC) is forensic evidence that an attack has occurred - a hash, a domain, a registry key, a named pipe.
• An indicator of attack (IOA) describes behaviour or intent - LSASS access, a suspicious parent-child process pair, abnormal authentication patterns. IOAs survive small changes that break static IoCs.

Triage workflow

1. Validate the alert against source data; rule out known-good activity.
2. Classify and prioritise using the severity scheme in the plan (impact, data sensitivity, blast radius, asset criticality).
3. Scope - which other hosts, accounts, and cloud tenants share the indicator? Query logs, not memory.
4. Preserve evidence early: capture volatile data, images, and logs before remediation destroys them, and record who handled what and when.
5. Document continuously in a case record with UTC timestamps, sources, and analytic reasoning.

Correlate across identity, endpoint, network, and cloud telemetry, and map behaviour to MITRE ATT&CK techniques so coverage gaps and the attacker's likely next steps become visible.

Worked example

A SIEM flags a successful login for a service account from an unusual country. Validation: the account is normally used only by a batch job on one host. Scoping: check MFA and conditional access logs - MFA was satisfied by an "impossible travel" pair 40 minutes apart, and a second host authenticated with the same account 12 minutes later. Conclusion: credentials compromised, not a false positive. Because you queried identity logs before disabling the account, you retain the audit trail and identify both hosts in the first hour.

Traps

• Reimaging or deleting before evidence capture; it destroys both investigation and legal options.
• Treating a single IoC hit as proof, or a single mismatch as exoneration.
• Ignoring timezone drift between sources - normalise everything to UTC.
• Closing as a false positive without documenting the reasoning, so nobody can re-evaluate later.
• Declaring scope from the initially alerting host only.