Incident response

As explained in Cyber Threat Hunting

Incident response is the organized process of identifying, containing, investigating, and recovering from security incidents.

Incident response is the organized process for identifying, investigating, escalating, and handing over security incidents. It connects threat hunting with incident responders and other operational teams through recorded findings, notification, and escalation. section 4.6 section 11.0

A repeatable response workflow includes:

• Recognize a significant finding and open a security incident case. section 11.0 section 10.2.6
• Record the evidence, activities, tasks, severity, ownership, and current status. section 11.1.10
• Escalate or hand the case to the incident-response team while preserving collaboration with investigators. section 4.6 section 11.1.10
• Continue investigating and, when necessary, monitor the environment to determine compromise scope. section 10.2.6

Firewall exposure and compromised FTP server

Threat hunters found a permissive GCP internet-firewall rule exposing Windows and Linux servers. An adversary attacked the exposed FTP service, recovered a password, downloaded system files, and attempted SSH access. The team disabled the rule, documented the evidence in a high-severity incident case, and assigned it to incident response under investigation. section 11.1.10

Figure 10.5 Email containing the deception alert details

Use the deception alert artifact as an example of how an alert becomes an incident requiring case assignment, investigation, and scope monitoring. section 10.2.6

How Cyber Threat Hunting covers it

How deep it goes

Explains case tracking and escalation through workflows and scenarios, but stops short of detailing complete containment and recovery procedures.

Examples

Uses deception alerts, permissive firewall rules, exposed FTP services, credential attacks, downloaded files, and incident case records.

What you can do after

Diagnose/debug with incident cases by documenting findings, escalating confirmed compromises, and supporting investigation of their scope.

How it connects

Connects threat hunting with threat intelligence, vulnerability management, system administration, detection engineering, and incident escalation.

liveBookmanning.com

Read Cyber Threat Hunting on liveBook Get the book at manning.com

Also explained in

• 

  liveBookmanning.com
  Data-Driven CybersecurityThe incident response life cycle is the sequence of activities through which a cybersecurity incident is detected, analyzed, contained, resolved, and recovered from.
• 

  liveBookmanning.com
  AI for Everyday ITAn incident response plan is a documented framework defining how an organization detects, contains, investigates, and recovers from incidents.

Compare how 3 books explain incident response →

Related concepts

• incident response teamimplemented by · An incident response team is a designated group responsible for coordinating the detection, analysis, containment, response, and resolution of security incidents.
• recoveryhas part · Recovery is the process of restoring access, data, computation, or system operation to an acceptable state after failure, loss, or disruption.
• workflowkind of · A workflow is an organized sequence of coordinated activities, tasks, or decisions through which work progresses toward an outcome.
• tabletop exerciseused by · A tabletop exercise is a facilitated, discussion-based simulation in which participants examine roles, decisions, and procedures for responding to a specified scenario.

This explainer was generated by Manning's knowledge graph from the text of Cyber Threat Hunting. The section links point to the parts of the book it draws on.