Incident Response Triage and Escalation
This domain tests the judgment to size an incident quickly, decide containment, preserve evidence in the right order, and escalate with a clear rationale.
Triage variables
- Severity is the product of business impact, confidence in the detection, and scope (hosts, accounts, data).
- Credibility: does a second, independent source corroborate the alert? A single EDR heuristic versus EDR plus network plus authentication logs are different animals.
- Scope: is it spreading? Lateral SMB sessions, new logons, or encryption activity change the clock speed.
- Escalation criteria and severity tiers (P1–P4) should be defined before the incident, so triage is a comparison against a written standard, not a mood.
Order of volatility and containment
- RFC 3227 order: CPU registers and cache, memory, temporary filesystem, disk, remote logs, archival media. Collect the volatile layer first.
- Containment options: network-isolate the host through EDR, disable the account and revoke sessions/tokens, block the hash or domain, sinkhole DNS. Isolating a host preserves memory; powering off destroys it.
- Chain of custody: hash evidence at collection, log every handler with time and purpose, use write blockers for disk images.
Worked example
EDR flags LSASS process access (Sysmon 10) on a workstation at 09:12; by 09:17 the same host has SMB sessions to twelve other workstations. Reasoning: credential dumping followed within minutes by lateral movement is an active intrusion, not a single-host malware event. Actions in order: isolate the host at the network layer without shutting it down, capture memory, reset the compromised account's credentials, and enumerate the twelve targets for 4624 type 3 and service creation (7045). Escalate to P1 with a stated scope estimate and a first timeline.
Traps that cost marks
- Powering off or reimaging the host, destroying memory, encryption keys, and injected code.
- Containing one host without scoping the rest, inviting reinfection.
- Escalating every alert to P1 or, conversely, sitting on a confirmed lateral movement.
- Reporting an incident without a UTC timeline and without hashing the evidence you cite.