Incident Response
What the exam tests
Incident response tests the workflow after an alarm: triage, case creation, evidence handling, investigation, escalation, and closure.
Core rules
- Alarms are leads; Cases are the record of response. A Case groups related alarms, evidence, notes, tasks, and timeline.
- Investigations provide a workspace to correlate logs, alarms, entities, and evidence; preserve the original evidence.
- Triage: validate the alarm, determine scope (user, host, entity), assign an owner, set priority, and decide escalate or close.
- SmartResponse can automate containment or enrichment, but automated actions need review and audit.
- Document decisions and closure rationale; closing without notes is not defensible.
- Link related alarms to one Case instead of opening duplicate cases.
Worked example
A malware alarm fires on a server. Validate the hash and process; search for the same hash across the entity; check lateral movement; create a Case, attach the alarm and relevant logs, assign an owner, and record containment. If the hash is benign, document the exception and tune the rule. The reasoning: contain first, then tune, so evidence is not lost.
Traps
- Closing an alarm without creating or updating a Case.
- Destroying or altering evidence before preservation.
- Opening one Case per alarm for a single incident.
- Skipping escalation because the alarm looks like a false positive.
- Using SmartResponse without checking permissions and audit.