Cisco 300-215 CBRFIR key terms

The ordered phases used to manage a security incident, typically preparation, detection and analysis, containment, eradication, recovery, and post-incident lessons learned. It gives teams a repeatable structure for handling intrusions.

A widely referenced publication from the U.S. National Institute of Standards and Technology that describes how to prepare for, detect, analyze, contain, and recover from computer security incidents. It is commonly used as a baseline for incident handling programs.

The work done before an incident occurs: building playbooks, defining roles, deploying logging and detection tooling, testing response plans, and ensuring communications and access are ready. Weak preparation directly slows later containment.

A documented, repeatable procedure describing the exact steps, owners, and tools for handling a specific incident type, such as ransomware or credential theft. It reduces decision time and inconsistency during high-pressure events.

A discussion-based simulation where responders walk through a realistic scenario to test plans, roles, and communications without touching production systems. It exposes gaps in playbooks and decision authority before a real incident.

The lifecycle phase in which monitoring data, alerts, and reports are triaged to confirm whether an incident occurred, determine its scope, and identify affected assets. It converts raw telemetry into an actionable incident declaration.

The rapid prioritization of alerts by severity, confidence, and business impact to decide which need immediate investigation. Effective triage prevents analysts from drowning in low-value notifications while real intrusions wait.

An alert that appears to indicate malicious activity but is actually benign behavior, such as an administrative script triggering a suspicious-process rule. Tracking false-positive rates helps tune detections without losing true coverage.

An alert that correctly identifies genuinely malicious or policy-violating activity. Confirming true positives drives incident declaration, scoping, and escalation to containment activities.

The formal decision to treat an event as a security incident, which activates the response plan, notifies stakeholders, and assigns an incident lead. Clear criteria for declaring incidents prevent both overreaction and dangerous delay.

The process of raising an incident to higher-tier analysts, management, legal, or executive stakeholders based on defined severity thresholds. Timely escalation ensures the right authority and resources engage before damage spreads.

A standardized score assigned to an incident reflecting business impact, data sensitivity, spread, and urgency. It guides resource allocation, notification obligations, and reporting timelines.

The actions taken to stop an incident from spreading, such as isolating a host, blocking malicious traffic, or disabling a compromised account. Containment balances stopping the attack against preserving evidence and business continuity.

The removal of the root cause of an incident, including deleting malware, closing the exploited vulnerability, and eliminating attacker persistence. It follows containment and must be verified before recovery begins.

The phase of restoring affected systems and services to normal operation, validating that they are clean, and monitoring closely for reinfection. Recovery ends only when confidence in system integrity is reestablished.

A structured retrospective after an incident that documents the timeline, root cause, response effectiveness, and corrective actions. Its output should feed back into preparation, detection tuning, and playbook updates.

The specific findings and improvement actions captured from an incident or exercise, assigned to owners with deadlines. Without tracked remediation, the same weaknesses recur in later incidents.

A documented, unbroken record of who handled digital evidence, when, and how, from collection through storage and analysis. Gaps or undocumented access can render evidence inadmissible or unreliable.

The principle that the most perishable evidence, such as memory and network connections, must be captured before more persistent data like disk contents. Following it prevents loss of critical artifacts during collection.

Information that disappears when a system is powered off or rebooted, including RAM contents, running processes, active network connections, and logged-in sessions. It often holds the clearest evidence of attacker activity.

A bit-for-bit copy of a storage device or memory space, usually verified with a cryptographic hash to prove integrity. Investigators analyze the copy rather than the original to preserve evidence.

The use of cryptographic digests such as SHA-256 to confirm that a forensic copy matches the original evidence and has not been altered. Mismatched hashes undermine the credibility of the investigation.

The practice of protecting potential evidence from alteration, deletion, or contamination, including write blockers, access controls, and documented collection procedures. It underpins both legal defensibility and technical accuracy.

The analysis of captured RAM to recover processes, injected code, credentials, network connections, and malware artifacts that never touch disk. It is essential for detecting fileless and in-memory attacks.

Malicious activity that executes in memory or through legitimate system tools rather than dropping traditional executable files on disk. It defeats file-scanning defenses and requires behavioral and memory-based detection.

An attack technique that abuses built-in operating system tools, such as PowerShell or WMI, to perform malicious actions while blending with normal administration. Detection depends on command-line and behavioral telemetry.

A technical artifact suggesting intrusion, such as a malicious file hash, domain, IP address, registry key, or command line. IOCs are useful for scoping and hunting but age quickly as attackers change infrastructure.

A behavioral signal focused on attacker intent and technique rather than static artifacts, such as unusual lateral movement or credential dumping. IOAs remain useful longer than file-based indicators because behavior changes more slowly.

A publicly maintained knowledge base of adversary tactics and techniques observed in real intrusions, organized by platform. Defenders use it to map detections, prioritize coverage gaps, and describe attacker behavior consistently.

A proactive, hypothesis-driven search through telemetry for undetected adversary activity, rather than waiting for alerts. Successful hunts often produce new detections and reveal gaps in logging.

A Windows system service that logs detailed process creation, network connections, file changes, and registry events to the event log. Its rich fields make it a core telemetry source for endpoint detection and hunting.

The continuous stream of log, network, and endpoint data collected from systems and security devices for monitoring and investigation. Coverage and retention of telemetry determine how far back an incident can be reconstructed.

A summary record of network conversations, including source and destination addresses, ports, protocol, byte counts, and timestamps, without full packet contents. It supports traffic baselining, exfiltration analysis, and lateral movement scoping.

The recording of full network packet contents for detailed protocol-level analysis. It provides the deepest network evidence but requires significant storage and privacy consideration.

The policy defining how long different log sources are stored and how quickly they are searchable. Short retention can make it impossible to establish an incident timeline or prove compliance.

The process of ordering events from multiple sources by timestamp to reconstruct attacker actions and system changes. Accurate time synchronization across sources is essential for a reliable timeline.

Dividing a network into isolated zones with controlled traffic between them, limiting how far an intruder can move after initial compromise. It is both a preventive control and a containment tool.

Techniques an attacker uses to move from one compromised host to others, often via stolen credentials or remote administration protocols. Detecting it early is critical because it precedes high-impact actions.

The extraction of account credentials or password hashes from a compromised system's memory or stores. Stolen credentials let attackers authenticate legitimately and evade many network defenses.

Any mechanism an attacker establishes to retain access across reboots, such as scheduled tasks, services, or registry run keys. Eradication is incomplete until all persistence mechanisms are found and removed.

Malware that encrypts or steals data and demands payment, often after spreading across shared storage and backups. Response emphasizes isolation, backup integrity checks, and careful scoping before recovery.