Security Operations, Monitoring, and Incident Response
Domain 6 - Security Operations, Monitoring, and Incident Response
This domain covers SOC workflows, log collection, SIEM detection, triage, and the incident-response lifecycle. Questions test what to do first and how to avoid destroying evidence.
Core rules
- NIST SP 800-61 phases: preparation; detection and analysis; containment, eradication, and recovery; post-incident activity.
- Centralize logs in a SIEM, normalize time, and retain them according to policy and legal requirements.
- Tune detections to reduce false positives; an alert is not automatically an incident.
- Triage by severity, scope, and business impact. Confirm before declaring.
- Containment can be network isolation, account disablement, or token revocation. Preservation of evidence matters during containment.
Worked example
A SIEM alerts on impossible travel for a finance account. The analyst verifies with the user through a separate channel, checks MFA and sign-in logs, and finds a successful login from a new location. Actions: revoke sessions and refresh tokens, reset credentials, review mailbox rules and data access, and scope other accounts. Disabling the account is reasonable but may tip off the attacker; revoking sessions first can limit access while preserving monitoring.
Traps
Deleting logs or rebuilding a host before evidence collection; treating every alert as a confirmed breach; closing an incident without lessons learned; and assuming MFA logs alone prove the legitimate user acted.