Security Operations and Incident Response
Domain 6 tests detection, triage, and coordinated response. Expect logging and SIEM use, alert triage, severity, playbooks, evidence handling, containment, eradication, recovery, communications, and post-incident review.
Core rules
- The incident lifecycle is preparation; detection and analysis; containment, eradication, and recovery; and post-incident activity. Containment may be short-term to stop spread, then longer-term to stabilize.
- Preserve evidence before destructive actions. Maintain chain of custody, capture volatile data when appropriate, and document timestamps and actions.
- Triage asks: what is affected, what is the scope, what is the business impact, and what is the attacker likely to do next?
- Playbooks make response repeatable, but analysts must adapt to scope. Communications must include technical, management, legal, and customer stakeholders as required.
- Post-incident review should produce corrective actions with owners and dates.
Worked example
A user reports a phishing email and later a suspicious login from a new country. The analyst confirms the account was used, disables active sessions, resets credentials and MFA, blocks the sender and indicators, reviews mailbox rules and logs for scope, and checks whether other users received the message. The reasoning is to contain the account, remove persistence, determine scope, and avoid closing on a single alert.
Traps
Do not wipe or rebuild a host before evidence is captured. Do not close an alert without checking scope. Do not confuse an event, an alert, and a confirmed incident.