Threat Detection, Investigation, and Response (TDIR)
Threat detection, investigation, and response (TDIR)
TDIR is the exam's end-to-end domain: how Exabeam surfaces detections, how an analyst triages an alert, builds an investigation timeline, decides scope and severity, and drives containment and closure. Expect questions that test sequencing, evidence handling, and whether you can separate an alert from an incident.
Core rules and concepts
- Detection is not a verdict. A correlation rule, behavioral model, threat-intel match, or watchlist hit creates a signal; the analyst validates it against entity context, asset criticality, and business purpose.
- Triage asks: what happened, which entities are involved, when did it start, is it still active, and what is the potential impact? Use the Smart Timeline or session view to order activity across identity, endpoint, network, and cloud.
- Investigation is iterative. Pivot from the initial entity to peer entities, related sessions, and authentication chains; scope before containment.
- Response must be proportional: suppress or close for benign, contain for confirmed malicious, escalate for high impact. Record rationale, evidence, and actions.
- Preserve evidence and chain of custody. Note timestamps, source logs, query strings, and analyst notes. Use UTC or state the timezone.
Worked example
An alert fires for impossible travel on a finance user: a login from Singapore followed by one from New York. Triage shows the Singapore login used a new device and MFA was satisfied, but the New York login came from the usual laptop. Reasoning: do not close as benign yet. Check the Singapore session's source IP, ASN, user agent, and MFA method; pivot to mailbox rules, file access, and VPN logs. If the Singapore login created a mailbox forwarding rule and downloaded a finance report, escalate to incident, disable the session, reset credentials, and preserve logs. If it was a corporate VPN egress or a known travel exception with verified MFA, document and close as benign.
Traps
- Treating a high risk score as proof of compromise.
- Closing on the first benign explanation without checking lateral activity.
- Containing before scoping, which can tip off an adversary.
- Losing marks by omitting timestamps, evidence, and closure rationale.