OSIR common mistakes
OSIR · Understand the traps and how to avoid them.
Treating containment as the first action after confirming a host is compromised, isolating it before capturing volatile state such as running processes, network connections, and memory-resident artifacts.
Candidates carry over a 'stop the bleeding' reflex from general incident response and read the scenario as a pure containment drill, forgetting that the exam tests whether they recognize when evidence preservation must precede or accompany isolation, especially when the host may be wiped or the attacker may persist elsewhere.
What to do instead
Before choosing containment, ask what evidence exists only on the live host and whether it will survive isolation. Practice writing a short ordered action list for a live compromised server: capture volatile data, note running sessions, then isolate while preserving the ability to reacquire. On the exam, look for wording like 'the host will be rebuilt' or 'attacker still active' to decide the order.
Classifying an event as an incident based only on severity of the alert text, without checking whether it meets the organization's documented incident criteria or escalation thresholds.
Alert fatigue and tool-centric thinking lead candidates to equate 'high severity' with 'incident', while the exam expects the candidate to apply the organization's own definitions and triage criteria rather than the SIEM's severity label.
What to do instead
Memorize the distinction between event, alert, and incident, and always look for the scenario's stated criteria (data classification, scope, business impact, regulatory trigger). When a scenario gives a policy or playbook, apply it literally before applying intuition.
Jumping to a root-cause narrative from a single indicator, such as concluding 'phishing' from one suspicious email or 'insider threat' from one after-hours login, and building the whole response around it.
Analysts are trained to find the story fast, and exam scenarios often plant a plausible but incomplete clue; candidates who do not enumerate alternative hypotheses or correlate multiple sources pick the first coherent story and then answer every later question consistently with it.
What to do instead
Use a structured hypothesis set: for each scenario, list at least three plausible explanations and the evidence that would confirm or refute each. Ask what telemetry would distinguish them (endpoint, DNS, proxy, authentication logs, EDR). Choose the answer supported by the most independent sources, not the most dramatic one.
Confusing the order of volatility or misapplying it, for example collecting disk images before memory, or treating a firewall log as more volatile than a running process list.
The concept is memorized as a list rather than as a principle about what changes or disappears fastest, so candidates misrank items under time pressure or when the scenario includes cloud and virtualized artifacts that were not in their study list.
What to do instead
Anchor on the principle: the more a source changes on its own or disappears on shutdown, the earlier it is captured. Practice ranking mixed sets that include CPU registers and cache, RAM, swap, network connections, running processes, temp files, disk, remote logs, and backups. Note that remote and centralized logs may outlive the host and can be preserved in parallel.
Describing chain of custody as a form or a signature alone, without addressing who had custody, when, where it was stored, and how integrity was verified at each transfer.
Candidates reduce chain of custody to 'document everything', which is too vague to answer questions about admissibility, gaps in custody, or which party is responsible after handoff.
What to do instead
Frame chain of custody as an unbroken, attributable record of every transfer: collector identity, date and time, location, purpose, storage conditions, and integrity check (hash) at acquisition and at each handoff. Practice identifying the specific defect in a described custody record, such as a missing hash after transport or an undocumented gap between seizure and lab intake.
Reading a packet capture or flow record only at the surface (source and destination IP, port) and missing protocol-level evidence such as TLS SNI, HTTP host headers, DNS query names, or beaconing periodicity.
Candidates without hands-on NSM experience default to IP-and-port reasoning, while the exam expects them to recognize that encrypted traffic still leaks metadata and that regular intervals and jitter are stronger indicators than a single connection.
What to do instead
Practice extracting the observable fields available at each layer: DNS query and response, TLS SNI and certificate details, HTTP method, host, user agent, JA3-style fingerprints, byte counts and direction, and timing. For beaconing questions, compute or estimate interval regularity and note jitter and retry behavior rather than relying on a single flow.
Treating a detected intrusion as closed once the alert is acknowledged or the malware is deleted, without verifying eradication, checking for persistence, or defining recovery and monitoring criteria.
The response lifecycle is often learned as a list of phase names rather than as a set of exit criteria, so candidates skip verification steps and answer 'eradicate' or 'recover' when the scenario is still in containment or requires validation before return to service.
What to do instead
For each phase, name the exit criterion: containment is complete when spread is stopped; eradication is complete when persistence mechanisms, accounts, and implants are removed and confirmed; recovery is complete when systems are restored, validated, and monitored for recurrence. On the exam, match the scenario's current evidence to the phase whose exit criterion has not yet been met.
Writing incident reports and stakeholder communications that mix technical detail with executive summary, or that omit impact, current status, and next update time.
Candidates write the report they would want as an analyst rather than the report each audience needs, and they underestimate how exam questions test audience-appropriate content, timing of notifications, and regulatory or contractual reporting triggers.
What to do instead
Separate the artifacts: a technical timeline with evidence references, and an executive summary covering what happened, business impact, current status, actions taken, and next steps with an owner and time. For notifications, identify the trigger (regulatory deadline, contractual clause, law enforcement involvement) and who is authorized to communicate externally before drafting content.
Assuming log sources are complete and trustworthy, for example treating an absence of alerts as absence of activity, or accepting a single timestamp without checking time synchronization across sources.
Candidates reason from what the tooling shows rather than from what the tooling can miss, and they forget that clock skew, log gaps, disabled auditing, and retention limits create blind spots that change the conclusion.
What to do instead
For any timeline or 'did this happen' question, check coverage first: which sources would record the activity, were they enabled and retained, and are their clocks synchronized to a common reference? Treat missing data as unknown rather than negative, and state the confidence level and the additional source that would resolve it.
Answering legal, privacy, and compliance questions from general intuition rather than from the jurisdiction, data classification, and contractual obligations stated in the scenario.
Candidates memorize frameworks by name but not their triggers, so they apply the wrong regime (for example invoking one regulation's breach clock when the scenario describes a different jurisdiction or a contractual notification clause) or overlook that evidence handling rules differ for regulated data.
What to do instead
Before answering, extract the scenario's facts: jurisdiction, data type and classification, contractual parties, and any stated policy. Then map those facts to the specific obligation and deadline named or implied. When the scenario is silent, choose the answer that preserves evidence and escalates to the responsible authority rather than assuming a deadline.