I85PREP
⌘ K
CPIT InfoSec study materials
CPIT InfoSec study resources

CPIT InfoSec: Security Operations, Monitoring and Incident Response

CPIT InfoSec · Work through your exam, one topic at a time.

All guide sections

Security Operations, Monitoring and Incident Response

Security operations, monitoring and incident response is about detecting, triaging and containing events before they become breaches, then learning from them. CPIT InfoSec tests the incident lifecycle, evidence handling, detection engineering, and the metrics that show whether a SOC is actually working.

Detection

  • Collect the logs that matter: identity (authentication, privilege change), endpoint (process, persistence), network (DNS, proxy, flow) and cloud control plane.
  • A SIEM correlates and alerts; success depends on use cases, not log volume. Detection engineering maps rules to MITRE ATT&CK techniques and tests them with simulated adversary behaviour.
  • Tune to reduce false positives but track false negatives; measure mean time to detect and mean time to respond per severity.

Incident response lifecycle (NIST SP 800-61)

  1. Preparation: plan, roles, contacts, tooling, playbooks, tabletop exercises.
  2. Detection and analysis: validate, scope, classify severity, open a ticket with a timeline.
  3. Containment, eradication and recovery: isolate hosts, rotate credentials, remove persistence, restore from clean backups, monitor for re-entry.
  4. Post-incident activity: lessons learned, control improvements, updated detections.

Preserve evidence with hashed disk and memory images, a chain-of-custody log, and analysis on copies. Escalate to legal and privacy when personal data is involved, because notification clocks may start at awareness rather than confirmation.

Worked example

A user reports a credential-harvesting page. Triage shows the link was clicked but no credentials were submitted, confirmed by the proxy log. Severity is low, but the sender is internal and 40 other staff received the same message. Containment: block the domain, purge the mail, force password resets for anyone who visited, and hunt for inbox rules and OAuth grants created in the window. Post-incident: add a detection for the sender pattern and refresh phishing training.

Traps

  • Declaring containment before scoping; the attacker may hold a second foothold.
  • Wiping and rebuilding a host before imaging it.
  • Starting the notification clock only after the full investigation.
  • Judging a SOC by alert count rather than detection coverage and response time.