Incident Handling
Incident Handling
The Incident Handling domain tests your ability to move an incident from detection to closure using a documented lifecycle, sound containment decisions, and defensible evidence. Expect preparation, triage, containment, eradication, recovery, communication, and lessons learned.
Core rules
- Preparation builds authority and capability before an event: policy, playbooks, contact trees, logging, forensic tooling, out-of-band communications, and pre-approved containment actions.
- Detection and analysis validate the alert, determine scope and timeline, identify affected accounts and data, and preserve volatile evidence before making changes when feasible.
- Containment has short-term and long-term forms. Short-term may isolate a host, block a destination, or disable an account; long-term may rebuild, segment, or add monitoring. Choose based on business impact and whether the attacker will detect the action.
- Eradication removes the root cause and persistence; recovery restores trusted service and monitors for recurrence. Keep an incident log, evidence hashes, and chain-of-custody records.
- Notify management, legal, privacy, and regulators according to policy. Do not speculate publicly.
Worked example
A file server begins renaming documents to .locked and a ransom note appears. The analyst isolates the server's switch port, preserves memory and logs where possible, disables the compromised service account, blocks known command-and-control destinations, and identifies the initial host. Reasoning: containment limits spread; evidence preservation supports scope and legal needs; credential reset and immutable-backup restore come only after the persistence mechanism is removed, followed by heightened monitoring.
Traps
Reimaging before collecting evidence; deleting malicious files before noting paths and hashes; containing one host without scoping the campaign; delaying notification; restoring from a backup that still contains the implant; and closing the incident without a lessons-learned review.