Detection and Analysis
The job of this phase
Detection and Analysis turns alerts into confirmed, scoped incidents. Triage answers five questions in order: what happened, is it real, what is the impact, what is the scope, and what happens next.
Concepts to know
- Data sources: endpoint and EDR telemetry, network (flow, DNS, proxy), identity and authentication logs, cloud audit logs, application logs, and physical access.
- Correlation and tuning: SIEM rules, alert fidelity (precision vs. recall), and the cost of false positives in analyst time.
- IOC vs. IOA: an indicator of compromise is an artifact (hash, IP, domain); an indicator of attack is behavior. The Pyramid of Pain ranks indicators by how much they hurt an adversary to lose - hashes and IPs are cheap, TTPs are expensive.
- Mapping to MITRE ATT&CK to describe behavior consistently and find detection gaps.
- Evidence handling: follow the order of volatility (registers and cache, memory, swap, network state, running processes, disk, logs, backups), maintain chain of custody, hash images, and use write blockers.
Traps
Rebooting a suspected host to "clean" it, destroying volatile evidence. Reversing the order of volatility. Treating the absence of alerts as proof of a clean environment. Confusing an IOC with a TTP. Accepting an alert's severity label without scoping. Ignoring time-zone normalization when building a timeline.
Worked example
An alert shows one workstation opening SMB sessions to many internal hosts. The analyst pivots: logon type 3 events from that host, a new service creation, and admin-share access on several servers. That pattern confirms lateral movement with stolen credentials - escalate to an incident, capture memory first, disable the account, then isolate.
Rule of thumb
Confirm, scope, then act. An alert confirms an event; only scoping makes it an incident.