Post-Incident Response Activity - Eradication Proof, Reporting, and Metrics
Domain 4 - Post-Incident Response Activity
This section covers what happens after containment: proving the threat is gone, recovering safely, documenting the incident for technical and executive audiences, honouring legal obligations, and converting findings into changes that measurably shorten the next response.
Proving eradication and recovering
Enumerate persistence and verify each item is removed; reimage rather than clean when the attacker held administrative rights; patch the entry vector; reset credentials and rotate keys. Restore from known-good backups only after confirming the backups predate the compromise, then monitor for at least 30 days against the IOCs and TTPs you documented.
Reporting
Produce two artifacts. An executive summary covering impact, scope, business cost, and decisions taken. A technical report containing the UTC timeline, evidence references with hashes, root cause, and recommendations with named owners and dates. Check legal hold and retention obligations before deleting anything, and check notification clocks - GDPR 72 hours, plus contractual and sector-specific rules.
Lessons learned
Hold a blameless review within about two weeks while memory is fresh, and convert each finding into a concrete change: new Snort/IPS signatures, Umbrella block lists, reviewed EDR exclusions, playbook edits, and a tabletop exercise for the exact scenario you just lived through.
Metrics that show improvement
Mean time to detect, acknowledge, contain, and recover; dwell time; the ratio of tool-detected to user-reported incidents; false-positive rate. A team whose detections came 80% from user reports has a visibility problem, not a staffing problem.
Worked example
A phishing incident: Umbrella's first DNS block at 09:14, the user's report at 11:40, host isolation at 12:05. Reasoning: detection time is measured from first evidence to detection - about 2.5 hours - while containment took roughly 25 minutes. The recommendation therefore targets the 2.5-hour gap: the block existed but no alert was routed to the SOC. Blaming containment would be wrong because it performed within target.
Traps
Declaring victory without hunting the IOCs again; running a review that assigns blame so nobody reports the real cause; deleting case data without a legal-hold check; writing recommendations with no owner or date; confusing eradication (threat removed) with recovery (business restored).