Incident Response¶
The incident response lifecycle and what happens in each phase. For step-by-step procedures for specific incident types, see the Incident Response Playbooks.
Frameworks¶
| Framework | Model |
|---|---|
| NIST SP 800-61 Rev. 3 | Current NIST guidance. Maps incident response activities to the CSF 2.0 functions: Govern, Identify, Protect, Detect, Respond, Recover |
| NIST SP 800-61 Rev. 2 | The four-phase lifecycle most teams still organize around: Preparation; Detection and Analysis; Containment, Eradication, and Recovery; Post-Incident Activity |
| SANS PICERL | The same lifecycle in six steps: Preparation, Identification, Containment, Eradication, Recovery, Lessons Learned |
This section follows the four-phase lifecycle.
Pages¶
| Page | Description |
|---|---|
| Preparation | The plan, team, visibility, and controls in place before an incident |
| Detection and Analysis | Validating alerts, scoping, and building the timeline |
| Containment, Eradication, and Recovery | Stopping the spread, removing the attacker, and restoring service |
| Post-Incident Activity | Lessons learned, reporting, and feeding improvements back in |