Monitoring, Detection, and Incident Response
What this domain tests
Monitoring, Detection, and Incident Response tests whether you can build useful telemetry, detect adversary behavior, triage alerts, and run a defensible incident lifecycle. Expect coverage of logging, SIEM, detection engineering, MITRE ATT&CK, containment, and evidence handling.
Core rules and concepts
- Telemetry first: collect identity, endpoint, network, cloud, and application logs with synchronized time and retained context. Missing logs cannot be reconstructed after an incident.
- Detection engineering turns hypotheses into tested rules. Map detections to ATT&CK techniques and tune for precision and recall.
- Triage validates the alert, scopes affected identities and assets, and decides severity using impact and confidence, not alert count.
- Incident response lifecycle: prepare, detect and analyze, contain, eradicate, recover, and learn. Containment must balance evidence preservation and business continuity.
- Evidence handling: preserve chain of custody, hash copies, restrict access, and document every action.
- SOAR and automation should accelerate routine steps but keep human approval for destructive containment.
Worked example
An impossible-travel alert fires for a privileged user, followed by many MFA push prompts. The analyst validates the source IP and device, confirms the user did not travel, and treats it as likely MFA fatigue. Containment: revoke sessions and tokens, reset credentials, block the source, and preserve authentication logs. Eradication: remove any registered attacker device. Recovery: re-enroll MFA and monitor. Lessons learned: add number matching, reduce push fatigue, and tune the detection to correlate failed MFA bursts.
Traps that cost marks
Chasing alert volume instead of risk; deleting or overwriting evidence; containing before scoping; confusing an IOC with a TTP; and closing incidents without lessons learned or detection updates.
Exam-ready summary
Collect the right logs, test the detection, scope before containment, and preserve evidence.