Detection, Alert Triage, and Incident Response
This domain tests the path from alert to validated incident and the response decisions that follow. Expect questions on triage ordering, severity, containment choices, evidence handling, and the difference between a false positive and a benign true positive.
Core rules and concepts
- Triage validates the alert, determines scope, assesses asset criticality, and decides whether to escalate, contain, or close. Severity should combine detection confidence, potential impact, and blast radius, not alert label alone.
- A false positive means the detection logic fired on activity that did not occur as described. A benign true positive means the activity occurred but is authorized. Both may be closed, but only after evidence is recorded.
- Incident response follows preparation, detection and analysis, containment, eradication, recovery, and lessons learned. Containment options include network isolation, account disablement, process termination, hash blocking, and credential reset.
- Preserve volatile evidence before it disappears: memory, running processes, network connections, logged-on users, and command history. Maintain chain of custody for collected artifacts.
- Do not power off a suspected compromised host unless instructed; shutdown destroys memory-resident evidence. Isolation that keeps power and management access is usually preferable.
- Communicate scope and confidence clearly. A single endpoint alert may be the visible part of lateral movement.
Worked example
A file server generates alerts for rapid file modifications, deletion of shadow copies, and an unsigned binary writing to many directories. Reasoning: this combination suggests ransomware-like impact, but confirmation requires checking encryption behavior, the parent process, service creation, SMB sessions, and backup integrity. Isolate the server at the network layer while keeping it powered, capture memory and process information, disable any compromised account, and check other hosts for the same binary and SMB connections. Do not delete the binary or restore from backup until the entry point and persistence are understood.
Traps that cost marks
- Powering off a host and losing volatile evidence.
- Deleting malware before collecting the process tree, command line, and persistence artifacts.
- Closing an alert as a false positive solely because the file is unsigned or the user is known.
- Ignoring low-severity precursor alerts that establish the timeline.