liveBook · Manning

Incident case

As explained in Cyber Threat Hunting

A structured record documenting the findings, impact, ownership, status, and response actions for a security incident.

An incident case is a structured operational record for communicating security findings, tracking investigation work, assigning ownership, and handing the case to incident response. section 11.0 section 11.1.7

Capture the investigation in repeatable fields:

  • Title, severity, category, status, owner, reporting source, and summary. section 11.1.7
  • Business impact, next steps, recommendations, escalation level, and assigned tasks. section 11.1.7
  • Update findings, activities, and tasks as the investigation develops before handing the case to incident response. section 11.1.10

Firewall exposure and follow-on compromise

A case began after a permissive GCP internet-firewall rule exposed Windows and Linux servers. It recorded the rule’s creator and disablement times, assigned investigation tasks, and initially marked exploitation as unconfirmed. The updated case documented an FTP dictionary attack, recovered credentials, downloaded files, and attempted SSH access. section 11.1.7 section 11.1.10

How Cyber Threat Hunting covers it

How deep it goes
Demonstrates initial and updated records with operational fields, investigation findings, task assignments, and escalation, without prescribing a universal template.
Examples
Uses exposed GCP services, a permissive firewall rule, FTP credential attack, downloaded system files, and attempted SSH access.
What it assumes
Assumes familiarity with threat hunting and security incidents while illustrating case fields and response coordination through a concrete scenario.
What you can do after
Operate/configure it to record findings, assign investigation work, track status, recommend monitoring, and transfer ownership.
How it connects
Connects threat hunting with incident response, firewall policy, unauthorized access, and incident escalation.
Cover of Cyber Threat Hunting
liveBookmanning.com
Read Cyber Threat Hunting on liveBook Get the book at manning.com

Related concepts

This explainer was generated by Manning's knowledge graph from the text of Cyber Threat Hunting. The section links point to the parts of the book it draws on.