Threat Detection, Monitoring, and Incident Response
Threat Detection, Monitoring, and Incident Response tests the path from telemetry to a defensible decision. GCT-2A-324 expects you to know what to log, how SIEM correlation and detection engineering work, how to triage an alert, and how the incident-response lifecycle preserves evidence and limits damage.
Core rules and concepts
- Centralize security-relevant logs - identity, endpoint, network, cloud audit, and application - with accurate time synchronization, retention, and access control. Missing logs are a detection gap, not just an operational inconvenience.
- SIEM correlation joins events across sources. Detection use cases should map to adversary behavior such as MITRE ATT&CK techniques, with tested logic, owners, and false-positive tuning. UEBA baselines behavior; SOAR automates repeatable response steps.
- The NIST SP 800-61 incident-response lifecycle is prepare; detect and analyze; contain, eradicate, and recover; and post-incident activity. Containment must not destroy evidence. Chain of custody, hashing, and order of volatility guide evidence handling.
- Triage confirms scope, severity, affected identities and assets, and whether the alert is a true positive. Metrics such as MTTD and MTTR measure detection and response, not simply ticket closure.
Worked example
SIEM alerts on impossible travel: a user authenticates from two distant countries within 20 minutes. The analyst checks whether a corporate VPN or proxy explains the geography, then reviews MFA results and endpoint telemetry. If a new device and successful MFA push are present, the analyst treats it as a suspected session takeover: revoke sessions and refresh tokens, reset credentials, isolate the endpoint if compromised, and preserve authentication and endpoint logs. The reasoning: the alert alone is not an incident, but the correlated evidence changes the response. Containment targets the session and identity first because they are the active access path.
Traps that cost marks
- Deleting or overwriting logs before evidence preservation.
- Containing a host before capturing volatile evidence when the response plan requires it.
- Closing an alert without scope, identity, and impact assessment.
- Skipping post-incident review, so the same detection gap recurs.