OSIR flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

CIA triad

Confidentiality ensures only authorized parties access data; integrity ensures data is accurate and unaltered; availability ensures timely and reliable access to systems and information.

Incident response lifecycle

NIST SP 800-61 phases: Preparation; Detection and Analysis; Containment, Eradication, and Recovery; Post-Incident Activity. These phases guide structured handling from readiness through lessons learned.

Event versus incident

An event is any observable occurrence in a system or network. An incident is an event or series that actually or potentially jeopardizes confidentiality, integrity, or availability of information.

MTTD and MTTR

Mean Time to Detect is total detection time divided by incident count. Mean Time to Respond is total response time divided by incident count. Both measure operational effectiveness.

SOC tier structure

Tier 1 validates and triages alerts; Tier 2 investigates, contains, and coordinates response; Tier 3 performs hunting, threat intelligence, and advanced forensics. Escalation follows defined criteria.

Chain of custody

A documented record of who collected evidence, when, where, and how, plus every subsequent transfer or access. Gaps can undermine authenticity and admissibility in legal proceedings.

Detection precision and recall

Recall (true positive rate) equals TP divided by TP plus FN. Precision equals TP divided by TP plus FP. High recall catches threats; high precision reduces analyst alert fatigue.

SIEM correlation rule

A rule that ingests normalized logs, applies condition logic over a time window, assigns severity, and triggers a response. Poorly tuned rules generate false positives and missed detections.

MITRE ATT&CK tactics

Tactics describe adversary goals such as Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration, and Impact.

Alert triage decision rule

Validate whether the event is real, determine scope across hosts, accounts, and data, assign severity, then escalate or close with a documented rationale. This standardizes analyst decisions.

Threat intelligence IOC aging

Indicators of compromise such as IPs, domains, hashes, and URLs decay over time. Aging and scoring feeds reduces false positives from stale infrastructure now used by legitimate services.

Time synchronization importance

NTP-aligned clocks across systems are required for accurate log correlation and timeline reconstruction. Skewed clocks break SIEM correlation and can invalidate forensic timelines.

Containment options

Isolate hosts from the network, disable accounts, block IPs or domains at egress, revoke sessions and tokens, or segment VLANs. Selection balances business impact against evidence preservation.

Order of volatility

RFC 3227 sequence: CPU registers and cache, RAM, network state, running processes, disk, logs, backups, printed media. Capture the most volatile evidence first before it is lost.

Eradication versus recovery

Eradication removes the root cause such as malware, a vulnerable service, or a compromised credential. Recovery restores trusted state and validates it through monitoring before returning to production.

Live system shutdown caution

Do not power off a live system before volatile capture unless it actively causes harm. Powering off destroys RAM evidence including encryption keys, processes, and network connections.

Ransomware response priorities

Isolate affected segments, preserve encrypted samples and logs, identify patient zero, and verify backup integrity before restoration. Rushing restoration without validation can reintroduce the threat.

Lessons learned output

Post-incident review should produce tracked corrective actions with owners and due dates. A narrative alone without measurable follow-up does not improve future response capability.

Forensic image hashing

Compute a cryptographic hash such as SHA-256 at acquisition and re-verify during analysis. Any mismatch indicates the copy was altered and invalidates its evidentiary value.

Write blocker purpose

A hardware or software write blocker prevents modification of source media during acquisition. Document the blocker model and configuration to support authenticity of the resulting image.

Memory acquisition value

RAM capture reveals running processes, network connections, encryption keys, and injected code that may not exist on disk. Acquire memory before shutdown when feasible.

MAC times

File system timestamps for Modified, Accessed, and Changed (MFT entry) plus Created. Correlate with logs and registry timestamps while accounting for time zone and clock skew.

Windows forensic artifacts

Key artifacts include Security event logs 4624, 4625, and 4688; Prefetch; Amcache; ShimCache; UserAssist; SRUM; $MFT; $UsnJrnl; and registry hives. Each supports timeline and execution analysis.

Admissibility factors

Evidence admissibility depends on relevance, authenticity, completeness, reliability, and documented chain of custody. No specific forensic tool is required by law.

PCAP analysis workflow

Identify conversations, filter by protocol or port, follow streams, extract objects, and correlate with host logs. This sequence narrows large captures to relevant evidence efficiently.

Beaconing indicators

Regular interval connections, consistent small payloads, jitter, rare domains, TLS SNI mismatch, and long low-volume sessions suggest command-and-control beaconing. Correlate with endpoint telemetry.

DNS tunneling signs

High volumes of TXT or NULL queries, long subdomain labels, high entropy in query names, and unusual query types indicate possible DNS tunneling. Compare against baseline DNS behavior.

NetFlow versus PCAP

NetFlow and IPFIX provide metadata such as five-tuple, bytes, and duration but not payload. Full packet capture provides content. Combine both for context and evidence.

TLS inspection alternatives

Without a proxy and CA for decryption, analyze SNI, certificate metadata, JA3 and JA3S fingerprints, and flow behavior. These reveal client and server characteristics without payload access.

Incident report structure

Include summary, timeline, scope and impact, root cause, evidence, actions taken, recommendations, and appendices. Separate executive summary from technical annex for different audiences.

GDPR breach notification

Article 33 requires notifying the supervisory authority within 72 hours of awareness unless unlikely to result in risk. Article 34 requires notifying data subjects when high risk exists.

Reporting metrics

Track MTTD, MTTR, incidents by severity, false positive rate, containment time, and recurring root causes. These metrics demonstrate program effectiveness and guide improvement investments.