Detection and incident response
Lesson 1 of 6
1Detection and incident response
The big pictureA breach takes 247 days on average to find and contain, and those over 200 days cost clearly more. A detection team does not promise nothing will happen, but that it will be caught quickly and contained before it grows.
What the picture shows: The NIST incident response cycle on a ransomware incident: each phase answers questions, and the lessons learned bring you back to preparation stronger.
Map of this part
The concepts in order, click any one to jump to it:
Two ways into the same idea
Think of a fire brigade. Before the fire: smoke detectors, an evacuation plan, drills (preparation). A detector beeps: where is it, how big? (detection). Close the doors so it does not spread, put it out and repair the damage (containment and recovery). Then: why did it start, what do we change? (lessons). The security operations centre is the fire station of the digital world.
A SOC in tiers: tier 1 triage, tier 2 investigation, tier 3 threat hunting and detection engineering. A SIEM collects logs (firewall, servers, EDR, identity, cloud), normalises and correlates them with detection rules (Sigma, for example) mapped to ATT&CK. SOAR automates repeated response with playbooks. The NIST SP 800-61 cycle: preparation, detection and analysis, containment-eradication-recovery, lessons learned (its latest revision maps it to the CSF 2.0 functions). DFIR: collect evidence in order of volatility (memory before disk) and keep the chain of custody. Metrics: MTTD and MTTR.
Before You Start
🎯How attackers think
Attack stages and ATT&CK tactics.
🐍Python (stage 1)
To read the script; you can run it without writing a line.
The Core Idea
1The security operations centre
Analysts watching alerts around the clock. Tier 1 triages: is the alert real or a false alarm? Tier 2 investigates the real ones and sizes them. Tier 3 hunts for attackers who set off no alert and writes new detection rules. SOC analyst is the most common first job in the field.
2From logs to alerts: SIEM and SOAR
Every device writes logs: who signed in, when, from where. Alone they say little, but when a SIEM gathers them in one place and correlates them, the story appears: five failed sign-ins from an odd country, then a success, then a new mail-forwarding rule. SOAR runs repeated steps automatically, such as disabling the account and opening a ticket.
This is the phase-three task of the study plan in miniature. Run it, then change the alert threshold of 3.
from collections import Counter
import re
log = """\
Nov 02 03:11:04 srv sshd[812]: Failed password for root from 203.0.113.7 port 51022
Nov 02 03:11:06 srv sshd[812]: Failed password for root from 203.0.113.7 port 51024
Nov 02 03:11:09 srv sshd[815]: Failed password for admin from 198.51.100.23 port 40110
Nov 02 03:11:12 srv sshd[812]: Failed password for root from 203.0.113.7 port 51031
Nov 02 03:12:40 srv sshd[901]: Accepted publickey for sara from 192.0.2.15 port 52200
Nov 02 03:13:02 srv sshd[812]: Failed password for invalid user test from 203.0.113.7 port 51090
"""
failed = Counter(re.findall(r"Failed password for .* from (\S+)", log))
for ip, count in failed.most_common(5):
flag = " <- investigate" if count >= 3 else ""
print(f"{ip:15} {count} failed{flag}")3The incident response cycle
The opening drawing shows the four phases. The key rule of containment: do not destroy the evidence. Reinstalling a machine at once erases what you need to know how the attacker got in and how far they went, and they may come back through the same door.
| Phase | The analyst asks | In a ransomware case |
|---|---|---|
| Preparation | Do we have a plan, tools and tested backups? | Offline backups and a ready call plan |
| Detection & analysis | What happened? When? How far? | An EDR alert on mass file encryption |
| Containment | How do we stop the spread without losing evidence? | Isolate infected machines, disable the stolen account |
| Eradication & recovery | Is every trace gone? How do we come back safely? | Rebuild from clean images and restore from backups |
| Lessons learned | Why did it work? What do we change? | Enforce MFA on the VPN and patch the exposed server |
Digital forensics (DFIR) collects evidence in order of how fast it disappears: memory first, because it vanishes when the machine is turned off, then the disk, then the logs. It keeps a chain of custody: who touched the evidence and when, so it holds up before an authority.
4For the plain path: if your account is hacked
Five steps, in order: (1) change the password from a clean device and turn on MFA. (2) Sign out of every active session in the account settings. (3) Change the password on any other site where you used it. (4) Tell your friends not to trust recent messages from you. (5) If money was lost, call your bank at once and report it to the authorities.
Worked example
The task: 2 a.m., an EDR alert: "mass file encryption on file server FS01". What are your first three steps?
The answer: (1) isolate FS01 from the network now (via EDR or by pulling the port) without shutting it down, so the spread stops and memory survives. (2) Scope it: which account ran the process? Did that account touch other machines? Disable it and search the SIEM for its activity. (3) Escalate and notify per the plan: the incident lead and management, and check the offline backups are intact before any restore. Do not pay and do not reinstall before collecting evidence.
Myth vs Reality
| Myth | Reality |
|---|---|
| No alerts means we were not breached. | It may mean detection does not cover what is happening. That is why threat hunting exists. |
| The first step with ransomware is reinstalling. | The first is isolation; reinstalling at once wipes the evidence you need. |
Where you meet it at work
🖥️SOC analyst
Triages dozens of alerts a day and writes a clear summary of what they escalate.
🔍Forensic investigator
Analyses memory and disks to rebuild a timeline of the attack.
Test your understanding
The right first step when you find a machine hit by ransomware:
Isolation stops the spread and keeps the evidence. Reinstalling at once erases what you need.
Which tool gathers logs from everywhere and correlates them with detection rules?
A SIEM collects, normalises and correlates; SOAR then automates the response.
Why is memory collected before the disk in an investigation?
That is the order of volatility: the most fleeting first.
What does a tier 1 SOC analyst do?
Tier 2 investigates; tier 3 hunts and builds detection rules.
How does a SIEM differ from SOAR?
SOAR runs the playbook automatically: isolate a machine, disable an account.
Quick review cards
Check Your Understanding
How do SOC tier 1 and tier 3 differ?
Tier 1 triages incoming alerts; tier 3 hunts attackers who raised none and writes detection rules.
Why is "lessons learned" the most important phase in the long run?
Because it closes the door the attacker used; without it the same incident repeats.
Why are many false positives a security risk, not just a nuisance?
Because a worn-out analyst starts ignoring alerts, and the real one gets lost among them.
Resources for this lesson
Grouped by type. Start with the official docs for precision, or an article or video for the explanation.
Done with this lesson?
Sign in to save your progress.