Cisco 300-215 CBRFIR cheat sheet

NIST SP 800-61r2 defines the incident response lifecycle as Preparation; Detection and Analysis; Containment, Eradication, and Recovery; and Post-Incident Activity.

The PICERL model (SANS) sequences phases as Preparation, Identification, Containment, Eradication, Recovery, and Lessons Learned; containment precedes eradication.

Cisco's incident response approach is commonly expressed as the six-step NIST-aligned loop: Preparation, Detection, Analysis, Containment, Eradication, Recovery, plus Post-Incident.

Mean Time to Detect (MTTD) measures elapsed time from compromise to detection; Mean Time to Respond (MTTR) measures elapsed time from detection to containment.

A security incident is any actual or suspected event that violates an organization's security policy; an event is any observable occurrence in a system or network.

CSIRT roles typically include incident commander, analyst, threat intel lead, communications lead, and legal/compliance liaison; the commander owns decision authority.

Chain of custody requires documented, unbroken control of evidence from collection through disposal; each transfer records who, what, when, where, and why.

Volatile evidence collection order: CPU registers and cache, routing table/ARP cache, memory, temporary files, disk, remote logs, then archival media.

A lessons-learned review is the final phase and produces measurable improvements to detection rules, playbooks, and controls; it is not optional.

Cisco Secure Firewall (formerly Firepower) uses access control policies, prefilter policies, and intrusion policies; intrusion policies reference Snort rules and variable sets.

Cisco Secure IPS events carry a generator ID (GID), Snort ID (SID), revision, and classification; GID 1 indicates a text rule, GID 3 indicates a shared object rule.

Cisco Secure Network Analytics (Stealthwatch) detects anomalies via flow analysis; its detectors include exfiltration, C&C, data hoarding, and reconnaissance.

Cisco SecureX/Umbrella Investigate provides reputation and passive DNS for domains, IPs, and file hashes; Umbrella blocks by DNS-layer policy before TCP connection.

Cisco Secure Endpoint (AMP for Endpoints) uses cloud-based file conviction, exploit prevention, and device trajectory to show the process lineage of a detection.

Cisco Threat Grid (Secure Malware Analytics) provides sandbox reports including behavioral indicators, network IOCs, and a threat score from 0 to 100.

Cisco Talos publishes vulnerability and threat intelligence; Talos IR handles incident response engagements and publishes IOCs and blog analyses.

Cisco SecureX threat response correlates observables across integrated products to build a graph of sightings and relationships for investigation.

Syslog severity 0 (emergency) through 7 (debug); Cisco ASA/FTD log messages use %ASA-nnnnnn or %FTD-nnnnnn message IDs for filtering.

Order of volatility per RFC 3227: registers/cache, routing table/ARP cache/process table, memory, temporary files, disk, remote logs, archival media.

A forensic image is a bit-for-bit copy; verify integrity with SHA-256 and record the hash in the evidence log before and after imaging.

Write blockers prevent writes to the source drive during acquisition; hardware write blockers are preferred over software for court defensibility.

The ACPO principles: no change to data, access only by competent persons, an audit trail of all actions, and case officer responsibility for compliance.

On Cisco IOS devices, 'show tech-support' is a comprehensive diagnostic bundle; 'show logging' and 'show archive' preserve configuration change history.

Cisco IOS 'show file systems' and 'verify /md5' confirm image integrity; 'show version' captures running image and uptime for timeline anchoring.

Cisco FTD/ASA packet captures: 'capture' command on ASA, 'capture-traffic' on FTD; captures are stored in memory and must be exported before reboot.

NetFlow/IPFIX records provide flow-level evidence (5-tuple, bytes, timestamps) and are commonly exported to a collector for retention.

For network device evidence, export logs to a remote syslog or SIEM before containment actions that may clear buffers.

Containment strategies: isolate the host (NAC/quarantine), block the indicator at perimeter/DNS, segment the network, or disable the account; choose based on blast radius.

Cisco Identity Services Engine (ISE) can apply a quarantine authorization profile via Change of Authorization (CoA) to isolate an endpoint.

Eradication removes the root cause (malware, persistence, vulnerable software); recovery restores normal operations and validates with monitoring.

Recovery validation includes confirming clean images, patched systems, reset credentials, and re-enabled but monitored services.

IOC blocking in FTD/ASA uses network or URL objects in access control or security intelligence feeds; document the block with a ticket and expiry.

Post-incident report contents: executive summary, timeline, root cause, IOCs, actions taken, impact, and recommendations with owners and due dates.

Regulatory notification clocks vary: GDPR 72 hours to supervisory authority; many US state breach laws require notice without unreasonable delay.

Metrics to report: dwell time, MTTD, MTTR, number of affected hosts, and containment effectiveness; these feed the lessons-learned phase.

Communications during an incident follow a pre-approved plan with designated spokesperson and legal review before external statements.