Internship
Student login
← SOC & SIEM learning path
SOC & SIEM · Module 9 of 10

Incident response process

Handle confirmed incidents end to end.

📖 Key ideas

  1. NIST lifecycle: preparation; detection and analysis; containment, eradication and recovery; post-incident activity.
  2. Contain first to limit damage.
  3. Preserve evidence for investigation.
  4. Communicate with stakeholders and, when required, regulators (CERT-In within 6 hours for certain incidents).
  5. Write post-incident reports and improve controls.
💡 Real-life example: Incident response is firefighting with a plan: contain the fire, put it out, rebuild, then improve fire safety.
NIST IR lifecycleStandard incident response phases
ContainmentLimiting damage
EradicationRemoving the threat
Post-incident reviewLessons learned