Threat Management and Incident Response
Domain 6: Threat Management and Incident Response
This domain tests how threats are anticipated, detected, and handled. Expect questions on threat intelligence, MITRE ATT&CK, detection coverage, incident response phases, containment, evidence handling, communications, and post-incident improvement.
Core rules and concepts
- Threat intelligence must be relevant and actionable: prioritize campaigns, tactics, and indicators that match your sector, assets, and exposure. Raw feeds without context create noise.
- ATT&CK is a behavior catalog, not a scanner. Use it to map detections to adversary techniques and find coverage gaps.
- Incident response phases: preparation; detection and analysis; containment, eradication, and recovery; post-incident activity. Evidence must be collected in a forensically sound way, with chain of custody.
- Containment choices trade speed against evidence loss and business disruption. Isolating a host is not the same as disabling a user account or revoking tokens.
- Communications: define who speaks publicly, who notifies regulators, and how often updates occur. Legal privilege and privacy obligations affect what is shared.
- Lessons learned should produce owned, dated changes to controls, detections, and playbooks.
Worked example
A user reports a phishing email, and logs show a successful login from a new country followed by mailbox rule creation. The analyst revokes the user's sessions and refresh tokens, resets the password, removes the malicious rule, and checks for data access. The team hunts for the same sender and login pattern across the tenant, then notifies privacy and legal because mailbox data may have been accessed. Reasoning: token revocation closes the active session, not just the password; mailbox rules are a persistence mechanism; scoping before containment prevents missed accounts. Deleting the phishing email first would lose evidence.
Traps that cost marks
Do not treat every alert as an incident or every incident as a breach. Do not contain by powering off a host before collecting volatile evidence unless safety requires it. Do not skip scoping and assume one account is affected. Do not promise public details before legal and communications review. Do not close an incident without tracking corrective actions.