IR Level I cheat sheet

NIST SP 800-61 defines four lifecycle phases: Preparation; Detection and Analysis; Containment, Eradication, and Recovery; Post-Incident Activity.

The SANS/PICERL model uses six steps: Preparation, Identification, Containment, Eradication, Recovery, Lessons Learned; steps repeat until the incident is closed.

ISO/IEC 27035 structures IR as five stages: prepare, detect and report, assess and decide, respond, and learn.

NIST Cybersecurity Framework 2.0 core functions are Govern, Identify, Protect, Detect, Respond, and Recover.

Event versus incident: an event is any observable occurrence in a system or network; an incident is an event that actually or potentially harms confidentiality, integrity, or availability.

Severity score = f(business impact, scope of affected assets, data sensitivity, whether activity is ongoing); the resulting tier drives escalation and notification decisions.

Role split: incident commander owns decisions and escalation; handlers investigate and preserve evidence; communications lead controls messaging; legal counsel advises on obligations.

Core metrics are MTTD, MTTA, MTTC, and MTTR, each computed from an explicitly defined start timestamp (first telemetry versus first human report).

Escalation trigger rule: escalate when the severity tier threshold is crossed, scope extends beyond one host or subnet, or regulated data is suspected to be involved.

A complete IR plan contains policy and authority, roles, escalation paths, severity definitions, contact rosters, communication channels, and per-incident-type playbooks.

Playbooks are built per scenario class: ransomware, business email compromise, phishing, insider misuse, web compromise, DDoS, and data exfiltration.

Exercise tiers ascend in fidelity: seminar, tabletop, functional drill, full-scale simulation, and red team versus blue team engagement.

A jump kit holds a write blocker, validated imaging and hashing tools, sterile media, chain-of-custody forms, network taps, and an analysis laptop with current tool versions.

Out-of-band communication (separate bridge line, secondary mail domain, or off-network messaging) is required because responders cannot assume corporate email survives.

Log retention must exceed expected attacker dwell time and satisfy regulatory minimums; short retention silently caps the achievable detection and investigation window.

Preparation baselines: current asset inventory, network diagrams, Active Directory and cloud tenant documentation, centralized NTP, and time-zone normalization to UTC.

Pre-negotiated artifacts shorten response: external IR retainer, forensic firm contacts, cyber insurance notification channel, and law enforcement points of contact.

Capability metrics include time to assemble the team, exercise objectives met, and percentage of post-exercise corrective actions closed on schedule.

Order of volatility (RFC 3227): registers and cache, memory, network state, running processes, disk, remote logs, archival media; collect the most perishable first.

Atomic indicators (hash, IP, domain) are cheap for adversaries to change; behavioral TTP indicators sit higher on the Pyramid of Pain and last longer.

Corroboration rule: a single indicator is a lead, not a finding; confirm with at least two independent data sources before declaring an incident.

Standard log sources: EDR telemetry, SIEM correlation, DNS queries, web proxy, authentication logs, firewall and NetFlow, cloud audit trails, and SaaS access logs.

Timeline construction normalizes all sources to UTC and corrects clock skew; unverified host clocks create false sequencing conclusions.

Triage questions: what happened, when, which hosts and accounts, what data is exposed, is the activity ongoing, and who must be informed.

Alert outcomes are true positive, benign true positive, or false positive; only true positive and unresolved benign true positive cases escalate.

Evidence integrity: hash before and after analysis, document collector, time, location, and purpose, and maintain an unbroken chain of custody.

Detection engineering maps existing rules to MITRE ATT&CK techniques to expose coverage gaps, which then become hunt hypotheses.

Containment options ordered by evidence impact: network ACL or VLAN isolation, EDR host isolation, account disablement, DNS or IP blocking; powering off a host destroys volatile evidence.

Short-term containment stops spread immediately; long-term containment stabilizes the environment while eradication is planned.

Containment criteria are defined before action: confirm malicious activity, protect critical systems, preserve evidence, and avoid tipping off the adversary prematurely.

Eradication removes the foothold: delete malware, rebuild from known-good images, patch the exploited vulnerability, and invalidate stolen credentials and active sessions.

Rebuild-versus-clean rule: rebuild when persistence, rootkit activity, or configuration integrity is uncertain; clean in place only when compromise scope is fully established.

Active Directory Golden Ticket recovery requires resetting the krbtgt password twice with replication between resets to invalidate forged Kerberos tickets.

Recovery validates before return to service: clean-state confirmation, data integrity checks, closed entry vector, and heightened monitoring during a defined watch window.

Backups used for restoration are verified for integrity and checked for pre-compromise contamination; unverified archives reintroduce the attacker.

Ransomware sequence: preserve encrypted systems and logs first, check public decryptors and law enforcement channels, then restore from validated offline backups.

The lessons learned review occurs within roughly two weeks of closure while responder memory is fresh; attendees include handlers, system owners, legal, and communications.

Standing agenda: what happened, what worked, what did not, root cause, and corrective actions with named owners and due dates.

Root cause analysis uses the Five Whys or causal factor analysis to separate the proximate trigger from the failing control or process that allowed the incident.

The final report carries an executive summary, scope, timeline, root cause, business impact, evidence references, and prioritized recommendations.

Corrective actions stay open in a tracked register until verified effective; the next exercise or audit provides the retest evidence.

Trend metrics: incidents by type, MTTD, dwell time, MTTC, MTTR, reopened incidents, and repeat root causes across incidents.

Outputs feed preparation: updated playbooks, new detection rules, revised asset inventory, refreshed contact rosters, and training content.

Evidence retention follows legal, regulatory, and policy schedules; destruction occurs only after legal hold review and retention expiry.

Blameless framing increases reporting fidelity; disciplinary use of review findings suppresses future disclosure of incidents.

Intelligence tiers: strategic (risk and intent), operational (campaigns and actors), tactical (TTPs), and technical (atomic IOCs such as hashes, IPs, domains).

Source reliability is scored with the Admiralty system: letters A-F for source reliability and digits 1-6 for information credibility.

IOC half-life is short for hashes and IPs and long for TTPs; detection portfolios overweighted to atomic IOCs decay quickly.

Sharing standards: STIX for the data model, TAXII for transport, MISP for community exchange; TLP (RED, AMBER, GREEN, CLEAR) defines distribution limits.

Hunting is hypothesis-driven: start from an ATT&CK technique or behavioral hypothesis rather than an alert queue.

Hunt maturity ladder: ad hoc searching, hypothesis-driven, modeled against ATT&CK, then automated as production analytics.

F3EAD cycle: Find, Fix, Finish, Exploit, Analyze, Disseminate - pairs targeting with exploitation of newly collected data.

Hunt data requirements: EDR process lineage, DNS and proxy logs, authentication events, cloud audit logs, and network flow records retained long enough to cover the hypothesis window.

A successful hunt closes the loop by producing a durable detection analytic; an unsuccessful hunt documents the tested hypothesis and coverage evidence.

GDPR Article 33: notify the supervisory authority within 72 hours of becoming aware of a personal data breach unless it is unlikely to result in a risk; notify individuals when risk is high.

US SEC rules: public companies file Form 8-K Item 1.05 within four business days of determining that a cybersecurity incident is material.

HIPAA breach notification: affected individuals, HHS, and where applicable the media, without unreasonable delay and no later than 60 days from discovery.

NIS2 (EU): early warning within 24 hours, incident notification within 72 hours, and a final report within one month of a significant incident.

PCI DSS requires prompt notice to the acquiring bank and card brands; compromised entities typically must engage a PCI Forensic Investigator.

Legal hold suspends deletion and alteration of records once litigation, investigation, or audit is reasonably anticipated; it overrides routine retention destruction.

Attorney-client privilege can protect investigation findings when external counsel directs the work from the outset and confidentiality is maintained.

Ethical boundary: responders act only within authorized scope; civilian hack-back and counter-attack are generally unlawful, and evidence must be preserved for possible prosecution.

Privacy minimization applies during investigations: collect only the personal data needed, restrict access to need-to-know, and log every access to evidence.