I85PREP
⌘ K
Cisco 300-215 CBRFIR study materials
Cisco 300-215 CBRFIR study resources

Cisco 300-215 CBRFIR: Incident Response and Analysis - Lifecycle, Telemetry, and Containment

Cisco 300-215 CBRFIR · Work through your exam, one topic at a time.

All guide sections

Incident Response and Analysis - Lifecycle, Telemetry, and Containment

Domain 3 - Incident Response and Analysis

This is the operational core of the exam: the response lifecycle, how Cisco telemetry drives triage, and how to choose a containment action without destroying the evidence you still need.

Lifecycle

Preparation → Detection and Analysis → Containment, Eradication and Recovery → Post-Incident Activity (NIST SP 800-61). Answer every scenario question by naming the phase and the evidence that phase depends on.

Telemetry map

  • Secure Network Analytics (Stealthwatch): NetFlow behaviour analytics - beaconing, data hoarding, unusual peer groups, encrypted-traffic anomalies.
  • Secure Endpoint: detections, device trajectory, quarantine, host isolation.
  • Umbrella: DNS-layer blocks and Investigate for retrospective hunting.
  • Firepower/FTD: IPS events, file policy verdicts, Talos Security Intelligence feeds.
  • ISE: identity, posture, pxGrid context sharing, and ANC for network quarantine.
  • Secure Email/Web, Duo, and Cisco XDR: aggregation and cross-product response actions.

Containment decisions

Ask three questions: is the host still attacker-controlled, is it still producing evidence, and will containment itself destroy evidence? EDR isolation usually beats a switch-port shutdown because the agent keeps reporting while the blast radius is limited. Account containment is a separate action: disable in AD/ISE, revoke sessions and refresh tokens, and reset the KRBTGT account twice if a domain controller is suspect.

Worked example

At 02:10 an alert fires: server 172.16.5.20 sent 4 GB to a rare ASN over 443, and Secure Endpoint shows winword.exe spawning rundll32.exe. Reasoning: validate against a baseline first (is 4 GB normal for this host?); scope with NetFlow for other hosts talking to the same address; if the host is live, capture memory before containment; isolate through the EDR agent rather than the switch; block the destination at FTD and Umbrella; reimage only after evidence is preserved. Containing before scoping can destroy the only record of lateral movement.

Traps

Reimaging before acquisition; isolating by a method that silently kills your own telemetry; treating the first alerted host as the only compromised host; forgetting persistence - services, scheduled tasks, WMI subscriptions, SSH authorized keys, web shells - during eradication.