Sound the Alarm: Detection and Response
Detection
Logs are the raw material of detection. Know the common sources - firewall, network, endpoint, application, and operating system - and the common formats: syslog, JSON, XML, CSV, CEF. A SIEM ingests and normalizes logs, correlates events, and raises alerts on dashboards; SOAR automates response actions. An IDS detects and alerts (signature-based or anomaly-based); an IPS detects and blocks; EDR monitors endpoints; packet sniffers such as tcpdump and Wireshark capture and decode traffic. The MITRE ATT&CK framework maps adversary tactics and techniques, and the Pyramid of Pain ranks indicators by how much they hurt an attacker to lose.
Response
The NIST incident response lifecycle has four phases: Preparation; Detection and Analysis; Containment, Eradication, and Recovery; Post-incident Activity. Playbooks define who does what at each step. Triage ranks and validates alerts; escalation hands an incident to a higher tier or owner. Chain of custody preserves evidence integrity during investigation.
Continuity
Business continuity keeps operations running; disaster recovery restores systems after an event. RTO is the maximum acceptable downtime; RPO is the maximum acceptable data loss, measured as the age of the last good backup. Redundancy, failover, hot/warm/cold sites, and full, incremental, or differential backups implement these goals.
Traps
Ordering questions are frequent - you must contain before you eradicate, and you must detect before you contain. Do not let Recovery migrate into the CSF function list, and do not merge Detection and Analysis into two separate phases. RTO and RPO are routinely swapped.
Rule of thumb
Remember RPO = restore point: how much data can you lose? RTO = time out: how long can you be down?