IR Level I key terms

An event, or series of events, that actually or potentially threatens the confidentiality, integrity, or availability of information systems, or violates security policy, and requires a coordinated response rather than routine handling.

A documented set of roles, procedures, contact details, and decision criteria that guides an organization from detection through recovery, approved in advance so responders act deliberately instead of improvising under pressure.

A six-phase model of incident handling: preparation, identification, containment, eradication, recovery, and lessons learned. It stresses sequence and revisiting earlier phases whenever new evidence changes the picture.

A widely used government guide describing the incident handling lifecycle as preparation; detection and analysis; containment, eradication and recovery; and post-incident activity, with practical recommendations for team structure and documentation.

A predefined scale, usually combining business impact with urgency, that determines who is notified, how fast responders engage, and which escalation and external reporting obligations are triggered.

A table listing triggers, thresholds, named contacts, and timeframes for moving an incident to higher authority or to additional teams, removing ambiguity about who must be told and when.

A designated group with defined authority, skills, and communication channels responsible for receiving, triaging, investigating, and coordinating the response to security incidents across the organization and with outside parties.

A discussion-based rehearsal in which responders talk through a simulated scenario against the written plan, exposing unclear roles, missing contacts, and process gaps without disrupting production systems.

A pre-packed collection of forensic tools, write blockers, clean media, documentation forms, and communication devices kept ready so responders can begin fieldwork immediately, even if normal supplies are unavailable.

Collecting logs from servers, endpoints, network devices, and applications into a single time-synchronized repository that survives compromise of individual hosts and supports later investigation and reconstruction of events.

A secondary communication channel, separate from the possibly compromised corporate network, used to coordinate response when email, chat, or shared drives cannot be trusted for sensitive discussion.

Records of authorized hardware, software, and configuration states that let responders recognize unauthorized changes, bound the scope of an intrusion, and restore systems to a known-good condition.

A forensic artifact such as a file hash, IP address, domain, or registry key that suggests a system has already been breached, useful for confirming and scoping intrusions that are already known.

Observable behavior showing an adversary is actively pursuing an objective, such as credential dumping or unusual remote execution, which can reveal malicious activity even when specific artifacts are not yet known.

The rapid first-pass assessment of an alert to establish validity, potential impact, and urgency, deciding whether to escalate, collect more data, or close the alert as benign.

Software that aggregates and correlates logs from many sources, applies detection rules, and presents alerts and dashboards, acting as the central platform for monitoring, triage, and investigation.

A ranking of evidence sources from most to least perishable, such as processor registers and memory before disk and backups, guiding the sequence in which data is captured during collection.

The process of establishing which accounts, hosts, and data are affected by an intrusion, using log review, endpoint data, and threat intelligence to bound the investigation and target containment.

Short-term and long-term actions that stop an incident from spreading or causing further damage, such as isolating hosts, blocking traffic, or disabling accounts, while preserving evidence for later analysis.

Removing the underlying cause of an incident by deleting malware, closing the exploited vulnerability, disabling compromised accounts, and eliminating persistence so the threat cannot simply resume.

Restoring affected systems and data to normal, verified operation, including rebuilding from trusted images, confirming integrity, and monitoring closely for signs that the attacker has returned.

Dividing a network into zones with controlled traffic between them, which limits lateral movement and lets responders isolate a compromised segment without shutting down the entire environment.

Rebuilding a system from a known-good image instead of trying to clean it, the preferred recovery approach when the depth of compromise on a host cannot be established with confidence.

Testing restored systems against known-good baselines and watching for renewed attacker activity before declaring the incident closed and returning the environment to full trust.

A structured meeting held after an incident where responders compare what happened with the plan, identify what worked and what failed, and agree on improvements with named owners and deadlines.

A written record of the incident timeline, key decisions, business impact, and findings, used to brief leadership, support later audit or legal needs, and drive corrective actions.

A method for tracing an incident back to the technical and organizational conditions that allowed it to happen, rather than stopping at the immediate trigger or the first malicious file found.

The average elapsed time between the start of malicious activity and its discovery, a metric that shows how well monitoring, alerting, and detection capabilities actually perform in practice.

A tracked list of remediation tasks, owners, and due dates derived from incident findings, ensuring improvement commitments are completed and verified rather than quietly forgotten after the event.

Organized information about adversaries, their capabilities, and their intentions, collected and analyzed to inform defensive priorities and give context and meaning to individual alerts.

A knowledge base of adversary tactics and techniques observed in real intrusions, organized by attacker goal, commonly used to map detections, plan hunts, and assess coverage gaps.

A proactive, hypothesis-driven search through available data for signs of compromise that existing detections missed, rather than waiting passively for an alert to fire.

Tactics, techniques, and procedures describe how an adversary operates: their goals, their general methods, and the specific implementation details, which change slowly and are therefore durable detection targets.

A model describing intrusion stages from reconnaissance through weaponization, delivery, exploitation, installation, command and control, and actions on objectives, helping defenders identify where an attack can be interrupted.

A documented, unbroken record of who handled each item of evidence, when, and for what purpose, required for that evidence to be credible in disciplinary, legal, or regulatory proceedings.

A legal duty to inform regulators, affected individuals, or business partners within defined timeframes after discovering unauthorized access to protected data, with content and deadlines set by jurisdiction.

An instruction to preserve all potentially relevant records, logs, and systems once litigation or formal investigation is reasonably anticipated, suspending routine deletion and retention policies.

Pre-agreed boundaries for an investigation or hunt defining which systems may be touched, which techniques are permitted, and who authorizes escalation, protecting both responders and the business.

The decision and process for contacting police or other authorities, weighing investigative support and legal obligations against loss of control over disclosure, timing, and evidence handling.