OSDA cheat sheet

SOC tiers: Tier 1 triage and alert validation, Tier 2 deeper investigation and correlation, Tier 3 threat hunting, malware analysis, and detection engineering.

MTTD is the interval from event occurrence to detection; MTTR is the interval from detection to containment or resolution; both are measured per alert class, not globally.

Alert triage decision rule: true positive with confirmed scope escalates to incident; true positive without scope closes as benign-true-positive with tuning note; false positive feeds detection tuning.

Incident response phases: Preparation, Detection and Analysis, Containment, Eradication, Recovery, Post-Incident Activity; containment precedes eradication in all validated intrusions.

Chain of custody requires documented hash (SHA-256), collector identity, timestamp, and storage location for every artifact; unhashed evidence is inadmissible for internal review.

Escalation severity matrix: impact (data, availability, scope) multiplied by confidence (evidence quality) determines P1-P4; P1 triggers on confirmed data exfiltration or domain-wide ransomware.

SOC metrics: alert volume, false positive rate, dwell time, escalation accuracy, and detection coverage per MITRE ATT&CK technique.

Runbook structure: trigger condition, required data sources, triage steps, escalation contacts, containment actions, and closure criteria.

MITRE ATT&CK tactic order: Reconnaissance, Resource Development, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration, Impact.

Sigma is a vendor-neutral detection rule format; YARA matches file content and memory patterns; Suricata/Snort rules match network traffic signatures.

Detection rule quality: high-fidelity rules minimize false positives by combining multiple indicators (process parent, command line, network destination) rather than single-event matches.

Pyramid of Pain ranks indicators: hash and IP lowest value, then domain, network/host artifacts, tools, TTPs highest; detections on TTPs survive adversary tool changes.

Event correlation requires normalized time (UTC), consistent field naming, and a common schema such as ECS or OCSF before cross-source joins.

LOLBins (living-off-the-land binaries) such as certutil, rundll32, mshta, and regsvr32 are signed system binaries abused for download, execution, or evasion.

Beaconing detection: periodic outbound connections with low jitter to a single destination, consistent payload size, and regular interval standard deviation.

Log source priority for detection: EDR telemetry, DNS, proxy, authentication logs, then firewall flow data; absence of a log source is a blind spot, not a negative finding.

CVSS base score 0.0 none, 0.1-3.9 low, 4.0-6.9 medium, 7.0-8.9 high, 9.0-10.0 critical; base score excludes environmental and temporal modifiers.

Risk = likelihood x impact; a critical CVSS on an isolated non-production host may rank below a medium CVSS on an internet-facing asset.

EPSS estimates the probability a vulnerability is exploited in the wild within 30 days; combine with CVSS for prioritization rather than using either alone.

CISA KEV catalog lists vulnerabilities with confirmed in-the-wild exploitation; KEV membership outranks raw CVSS for remediation urgency.

Patch management cycle: inventory, assess, prioritize, test, deploy, verify; verification confirms the patch version is applied, not merely that deployment succeeded.

Vulnerability scanning is authenticated (credentialed) or unauthenticated; authenticated scans yield far fewer false positives and reveal missing patches directly.

Compensating controls (network segmentation, WAF rules, disabled service) reduce risk when patching is deferred; they must be documented with an expiration date.

False positive versus false negative in scanning: false positive reports a vulnerability that does not exist; false negative misses an existing vulnerability and is the greater risk.

EDR telemetry covers process creation, file writes, registry changes, network connections, and memory events; AV signature matching covers only known file hashes and patterns.

Defense in depth layers: perimeter firewall, IDS/IPS, network segmentation, endpoint protection, application allowlisting, and logging.

Network segmentation limits lateral movement; flat networks allow a single compromised host to reach all peers.

Host firewall rules default-deny inbound; application allowlisting blocks execution of unsigned or unapproved binaries regardless of hash novelty.

IDS detects and alerts; IPS detects and blocks inline; a false positive in IPS causes denial of legitimate traffic, so tuning precedes blocking mode.

Sysmon Event ID 1 process creation, 3 network connection, 7 image load, 8 CreateRemoteThread, 11 file create, 22 DNS query are primary detection sources on Windows.

Encryption defeats content inspection; TLS inspection or metadata-only analysis (SNI, JA3 fingerprint, certificate attributes) is required for encrypted traffic.

Zero trust removes implicit trust based on network location; every request is authenticated and authorized regardless of source subnet.

Access control models: DAC (owner grants), MAC (system labels), RBAC (role-based), ABAC (attribute-based); least privilege applies to all.

Authentication factors: something you know, have, are; MFA requires two or more distinct factor types, so password plus security question is not MFA.

Privilege escalation: vertical moves to higher privilege, horizontal moves to another account at the same level; both require detection on token and group changes.

Kerberoasting targets service account SPNs to request and crack service tickets offline; defenses include long random service account passwords and gMSA.

PAM controls: vaulting, session recording, just-in-time elevation, and periodic access recertification.

Active Directory tiering: Tier 0 domain controllers and identity systems, Tier 1 servers, Tier 2 workstations; credentials must not cross tiers downward.

AAA components: authentication verifies identity, authorization grants permissions, accounting logs activity.

Separation of duties prevents one identity from both requesting and approving privileged access; approval must come from a distinct principal.