Incident Detection, Escalation, and Response Workflow
This domain tests the mechanics of moving an alert to a closed incident: severity assignment, escalation tiers, containment decisions, evidence handling and notification obligations. Items reward process precision under pressure, not heroics.
Core rules
- Lifecycle. NIST SP 800-61 and the SANS PICERL model both run Preparation, Detection and Analysis, Containment/Eradication/Recovery, Post-Incident Activity. NIST 800-61r3 aligns the phases with CSF 2.0 functions, so expect either framing.
- Severity drives everything. Score on business impact and confirmed scope, not on the alert's own label. A medium alert on a domain controller outranks a critical alert on an isolated lab host.
- Escalation tiers. L1 triages and closes known-benign patterns; L2 performs host and log investigation; L3 or IR lead owns containment and command. Escalate on confirmed malicious activity, on privileged-account involvement, on data exposure, or when the SLA clock expires.
- Order of volatility (RFC 3227). Capture CPU and memory state, then network state, then disk, then remote logs, then archival media. Pulling the power plug destroys the most volatile evidence first.
- Containment options. Network isolation that preserves the sensor channel, account disable plus token and session revocation, DNS sinkholing, credential reset in the right order (service accounts and krbtgt last, after scope is known).
- Notification clocks. Examples: GDPR supervisory authority within 72 hours of awareness, HIPAA breach notification within 60 days of discovery, SEC material incident disclosure within four business days of the materiality determination. Legal counsel owns the final call; the analyst supplies the timeline.
Worked example
A file server begins renaming documents and a ransom note appears. Reasoning: this is confirmed impact on a critical asset with likely lateral spread. Escalate to L3 immediately, isolate the host at the switch or EDR policy while preserving the management channel, capture memory and volatile network state before any reboot, disable implicated accounts and revoke sessions, then hunt for the entry vector across the estate. Reimaging before memory capture destroys the only evidence of the encryption key source and the initial access path.
Traps that cost marks
Containing before collecting volatile evidence. Wiping and rebuilding a host before forensic imaging. Assigning severity from the alert label instead of business impact. Failing to timestamp decisions, which breaks both the post-incident review and any regulatory timeline.