OSIR key terms

The structured sequence of phases an organization follows to handle a security event, typically spanning preparation, identification, containment, eradication, recovery, and lessons learned. Each phase has defined entry criteria, owners, and documentation requirements.

The formal decision, made against documented severity criteria, that an observed event qualifies as a security incident and triggers the response plan. It activates escalation paths, on-call rotation, and record-keeping obligations.

A predefined scale that ranks incidents by business impact, data sensitivity, and scope so responders apply proportionate effort. The rating drives notification timelines, executive involvement, and evidence-handling rigor.

The documented chain of people and teams to contact as an incident grows in severity or exceeds a responder's authority. It names primary and alternate contacts, response-time expectations, and the criteria for moving up a tier.

The single individual who coordinates response activities, assigns tasks, and speaks with authority during an incident. The role separates decision-making from hands-on technical work so responders are not distracted by coordination duties.

The step of limiting an incident's spread, for example by isolating a host, disabling an account, or blocking network traffic. Short-term containment stops damage; long-term containment keeps the environment stable until eradication is complete.

Removing the root cause of an incident, such as deleting malware, closing the exploited vulnerability, or rebuilding a compromised system. It follows containment and precedes recovery into normal operations.

Restoring affected systems and services to normal, verified operation after the threat is removed. Recovery includes validation testing, heightened monitoring for recurrence, and confirmation that business functions meet agreed service levels.

A post-incident document that captures the timeline, root cause, response effectiveness, and concrete corrective actions with owners and due dates. It is reviewed with stakeholders and tracked to closure.

A structured method for determining the underlying condition that allowed an incident to occur, rather than only the immediate trigger. Common techniques include the five-whys method and fault-tree analysis.

Observable artifacts such as file hashes, malicious domains, registry keys, or unusual process behavior that suggest a system has been breached. They support detection and scoping but are not permanent proof of compromise.

Observable signs of adversary behavior or intent during an intrusion, such as unusual lateral movement or credential dumping, rather than static artifacts. They tend to be more durable than file-based indicators because behavior is harder for attackers to change.

A publicly maintained knowledge base of adversary tactics and techniques observed in real intrusions. Defenders use it to map detections, identify coverage gaps, and prioritize monitoring investments.

A security information and event management platform that centralizes logs from many sources, correlates events, and generates alerts. It underpins monitoring workflows but depends on well-tuned rules and reliable log ingestion.

Any system, application, or device that emits records ingested by monitoring tools, such as endpoint agents, firewalls, or identity providers. Coverage gaps in log sources directly limit what detections can succeed.

The iterative adjustment of alert logic and thresholds to reduce false positives while preserving true detections. Tuning uses historical alert data, environment baselines, and feedback from analysts who triage the alerts.

Logic that combines multiple events across sources or time to raise an alert that no single event would justify. Effective rules encode a plausible attack sequence and specify the fields, windows, and thresholds involved.

An alert that fires when no malicious or policy-violating activity actually occurred. High false-positive rates exhaust analysts and cause real alerts to be missed, so they are tracked and reduced through tuning.

The rapid assessment of an alert to decide whether it is benign, a true incident, or needs deeper investigation, and to assign priority. Triage relies on enrichment data, scope checks, and documented decision criteria.

A stream of data about known malicious infrastructure, tools, and actor behavior, consumed to enrich detections and investigations. Feed quality, freshness, and relevance to the organization's sector determine its value.

A documented, unbroken record of who handled evidence, when, where, and for what purpose from seizure through disposition. Gaps or inconsistencies can render evidence inadmissible or unusable in proceedings.

The principle of collecting the most perishable evidence first, such as memory and network connections, before more persistent data like disk contents. Following it prevents irreversible loss of transient artifacts.

A bit-for-bit copy of a storage device or memory region, created with a write-blocking method so the original is unaltered. Investigators work from the copy and verify it against a recorded hash.

Using a cryptographic digest such as SHA-256 to demonstrate that a forensic copy matches the source and has not changed. Matching hashes recorded at acquisition and at analysis support authenticity claims.

The property that collected data is authentic, complete, and unmodified since acquisition. It is preserved through write blockers, hashing, secure storage, and documented handling procedures.

Information that disappears when a system loses power, including running processes, network connections, logged-in sessions, and memory contents. It must be captured early and its collection documented.

A directive to preserve all potentially relevant records and systems when litigation or investigation is reasonably anticipated. It suspends routine deletion and requires documented acknowledgment from custodians.

Summarized records of connections, such as source and destination addresses, ports, byte counts, and timestamps, without payload content. Flows reveal patterns like beaconing and data transfer volume while using far less storage than full packet capture.

Recording full or partial network packet contents for later analysis. Captures provide definitive protocol-level evidence but require significant storage and raise privacy considerations that policy must address.

A sensor that inspects network or host activity and raises alerts on suspicious patterns. Signature-based systems match known attack patterns; anomaly-based systems flag deviations from a learned baseline.

Regular, periodic outbound connections from an infected host to attacker infrastructure, often with jitter to evade pattern matching. Detecting it relies on timing analysis of flow or proxy logs rather than payload inspection alone.

The channel attackers use to send instructions to compromised systems and receive results. It may use common protocols, encrypted tunnels, or legitimate cloud services to blend with normal traffic.

Techniques an intruder uses to move from one compromised host to others inside a network, often via stolen credentials or remote administration tools. Detecting it depends on identity and endpoint telemetry, not perimeter logs alone.

Dividing a network into zones with controlled traffic between them so a compromise in one area cannot spread freely. It limits blast radius and creates chokepoints where monitoring is concentrated.

Granting users, services, and systems only the access needed for their defined tasks, for only as long as needed. It reduces the impact of compromised accounts and simplifies investigation of anomalous access.

An identity with elevated rights such as administrative control over systems, directories, or cloud tenants. These accounts warrant stricter monitoring, vaulting, and separation from routine daily use.

The obligation to inform a regulator, affected individuals, or law enforcement within a defined timeframe after certain incidents, such as a data breach. Timelines and thresholds vary by jurisdiction and sector.

The policy defining how long each category of log or record is kept and how it is protected from alteration or deletion. Retention periods must satisfy investigative needs and legal or regulatory minimums.

A facilitated meeting held soon after an incident or exercise to compare what happened with what was planned and to agree on improvements. Findings feed tracked corrective actions rather than remaining informal discussion.

A discussion-based scenario walkthrough in which participants practice roles, decisions, and communications without live systems. It tests plans and reveals unclear responsibilities before a real incident occurs.