Detection and incident response

How does a security signal differ from an incident?

A signal is evidence that may merit investigation; an incident is an assessed situation requiring coordinated response. A high-severity vendor alert is input to that assessment, not automatic proof of compromise.

What fields make authentication events useful for investigation?

Actor and account identifiers, authentication method, outcome, session/device context, source information, timestamp, and correlation identifiers. Avoid credentials and tokens, and document missing or provider-specific fields.

How do you reduce the chance an intruder erases the investigation trail?

Send logs promptly to an independently controlled destination, restrict deletion and configuration changes, monitor gaps, and apply appropriate retention protection. Local logs on a compromised host are valuable but not fully trustworthy.

Why preserve both event time and ingestion time?

Delayed delivery and clock skew can otherwise hide event order or create false correlation. Normalize display time zones, keep original timestamps, and use causal identifiers where clocks cannot establish precise sequence.

No malicious event appears in the logs. What must be checked before concluding it did not happen?

Whether the relevant source, event type, account, region, and time period were collected completely. Absence of evidence is weaker when logging was disabled, delayed, sampled, or inaccessible.

Why can a parser change silently disable a detection?

Fields may be renamed, typed differently, or dropped while ingestion still reports success. Test schema expectations and known-event matches, and monitor field completeness rather than only event volume.

What risk comes from normalizing several vendors' events into one schema?

Different actions or outcome meanings may collapse into misleading common labels. Preserve source context and validate semantic mappings, especially for denied versus successful operations and actor versus target identities.

How can event correlation strengthen a suspicious-login alert?

Combine login context with subsequent role changes, new credentials, sensitive reads, or unusual exports. Related behavior can distinguish compromise from travel or VPN use, provided identity and time joins are reliable.

A detector has few false positives per benign event. Why can most alerts still be false?

Malicious events may be much rarer than benign ones. Evaluate alert precision at production prevalence and volume; a small false-positive rate multiplied by millions of events can overwhelm responders.

How should alert precision be estimated?

Review a representative sample of alerts with a clear true/false/unknown adjudication policy. Report uncertainty and selection bias; labels from only escalated cases overstate quality and ignore ambiguous alerts.

Why is production detection recall hard to measure?

The full set of attacks is usually unknown. Use controlled exercises, known incidents, and telemetry coverage to estimate particular capabilities, without presenting those limited denominators as all-attack recall.

What should guide a detection threshold besides the number of alerts?

Expected harm, baseline variation, investigation capacity, false-positive cost, and time to act. Backtest multiple periods and segments, then monitor drift rather than tuning only to make today's queue small.

Why might 'role granted, then bulk export' be stronger than either event alone?

The sequence can represent a coherent abuse path. Define actor/resource linkage and a meaningful time window, and account for legitimate maintenance; temporal proximity alone does not establish that the events belong together.

How do indicator-based and behavior-based detections complement each other?

Known hashes or domains can provide precise matches but become stale or easy to change. Behavioral rules can generalize across tooling but often need richer context and tuning; neither category guarantees better coverage universally.

What should be checked before blocking a threat-intelligence IP?

Source reliability, freshness, shared-hosting context, confidence, and likely business impact. An IP can serve legitimate users or be reassigned; indicators need expiry and an exception or rollback process.

What makes a detection allowlist dangerous?

Broad or permanent exclusions can hide later compromise of a trusted identity or tool. Scope exceptions to justified behavior, assign an owner and expiry, and continue monitoring critical actions where possible.

What should detection tests include beyond one malicious example?

Benign lookalikes, missing fields, delayed events, duplicates, schema changes, and boundary windows. Check that the alert carries enough context for response and that expected nonmatches remain quiet.

Why replay historical telemetry before enabling a new rule broadly?

It estimates alert volume and reveals benign patterns across real workload cycles. Historical success does not guarantee future coverage, and datasets must include representative sources and known positive examples.

What does a periodic synthetic security event verify?

The collection, parsing, rule evaluation, routing, and response-notification path for that event. It tests pipeline health, not detection of every attack; keep test events distinguishable during investigation.

What should the first triage pass establish?

Whether the evidence is credible, which identity and assets are involved, current activity, potential impact, and immediate containment options. Record uncertainty and escalate based on risk rather than waiting for a complete root cause.

How should security incident severity be determined?

By demonstrated or plausible impact, scope, active attacker capability, sensitive data, and urgency. A quiet credential compromise can be more serious than a noisy blocked scan; volume alone is a poor severity measure.

What belongs in an investigation case record?

Evidence references, timeline, hypotheses, checks performed, decisions, actions, owners, and unresolved questions. Separate observed facts from interpretations so another responder can continue without reconstructing the reasoning.

Why preserve relevant evidence before destructive remediation when feasible?

Reimaging or deleting resources can remove volatile state and logs needed to understand scope. Balance preservation with stopping active harm; record what was collected, what changed, and why immediate containment took priority.

What does chain of custody document?

Who collected, transferred, accessed, and stored evidence, when, and using which integrity checks. It supports traceability but does not by itself establish the evidence's original truth or completeness.

What does hashing a captured file establish?

A digest can show whether that captured byte sequence changed later, assuming a suitable hash and protected reference. It does not prove when the file was created, who created it, or that the compromised source was honest.

How does containment differ from eradication?

Containment limits ongoing access or spread; eradication removes the intrusion mechanism and persistence. Isolating a host can contain it while malicious software and stolen credentials still require investigation and removal.

What should be considered before isolating a production host?

Current harm, service criticality, lateral access, evidence needs, and how responders will retain safe management access. Choose a bounded action and coordinate dependencies so containment does not unnecessarily destroy recovery capability.

What must happen after a cloud key is exposed?

Revoke or disable it, identify its effective permissions and use, rotate dependent secrets where needed, and investigate actions during exposure. Deleting the public copy does not revoke credentials already obtained by others.

Why may changing a password fail to stop a stolen-session attacker?

Existing sessions or access tokens can remain valid. Revoke affected sessions and refresh-token families according to the system design, assess newly registered factors or keys, and verify the attacker cannot immediately regain access.

After disabling the compromised account, what persistence should be investigated?

New identities, API keys, role trusts, OAuth grants, scheduled jobs, deployed code, and altered recovery settings. Use the environment's actual mechanisms; revoking the original entry credential may leave secondary access intact.

How do you estimate the scope of a compromised service identity?

Map its effective permissions, accessible data and secrets, observed actions, and potential delegation paths. Separate confirmed access from possible access, and include downstream credentials the workload could retrieve.

Why is a successful data-read event not proof of external exfiltration?

It shows access under the event's semantics, not necessarily transmission outside the environment. Correlate exports, egress, destinations, and endpoint evidence, while documenting uncertainty rather than claiming no leak from missing network data.

Why can restoring backups before containing identity compromise fail?

The attacker may still have privileges to re-encrypt or delete restored systems. Contain access and persistence, establish a trusted recovery environment, and validate backups and keys before reintroducing service.

What makes a recovery image 'known good'?

Its source, build, artifact integrity, configuration, and dependencies are trusted relative to the incident. An old image is not automatically safe if the build pipeline or shared credentials were compromised before it was produced.

Why plan the order of credential rotation?

Rotating a secret into a still-compromised host or build system can immediately expose the replacement. First secure the issuing and consuming paths, then rotate and verify propagation without leaving old access usable.

What evidence supports restoring normal service after containment?

The exploited path is addressed, persistence and affected credentials are handled, required systems are rebuilt or verified, and enhanced monitoring is active. Define residual uncertainty and rollback rather than equating a quiet dashboard with eradication.

What should an internal security update communicate?

Known impact, containment status, required actions, uncertainty, and the next update time. Use an appropriate audience and protect sensitive evidence; speculative attribution should not be presented as fact.

Who should coordinate external incident notifications?

The designated incident, communications, legal/privacy, and business owners under the organization's process. Provide verified technical facts and evidence promptly; obligations and timing depend on the incident and applicable requirements.

How should a suspicious attachment be examined safely?

Use an authorized isolated analysis environment with controlled network access and evidence handling. Do not open or execute it on a responder's normal workstation; static inspection and reputable tooling may answer initial questions without execution.

Why should investigation queries be saved with their time range and scope?

Results depend on retention, delayed ingestion, filters, and evolving data. Saving the exact query and cutoff makes findings reproducible and prevents 'no results' from being mistaken for a complete historical search.

Which containment actions are suitable for automation?

Actions with reliable triggering evidence, bounded impact, clear authorization, and a tested recovery path. High-impact account or network changes need stronger safeguards than adding context to an alert.

Two response playbooks act on the same identity. What can go wrong?

Conflicting state changes can re-enable access, overwrite evidence, or repeatedly rotate credentials. Use coordination, idempotent actions, state checks, and explicit ownership for concurrent response workflows.

Why can a single mean time to respond be misleading?

Incident types, severity, detection delays, and clock definitions differ, while a few long cases skew the mean. Track well-defined stage durations and distributions, with outcome quality and unresolved cases included.

What uncertainty affects an estimate of attacker dwell time?

The first observed event may be later than initial access because earlier evidence is missing. Report earliest confirmed activity and known coverage limits rather than treating log retention start as the intrusion date.

What should a security post-incident review change?

Controls, telemetry, access design, response procedures, or ownership tied to observed failure paths. Assign verification and due dates; generic reminders to 'be careful' do not demonstrate reduced risk.

What is the purpose of a purple-team exercise?

Defenders and authorized testers validate whether selected adversary behaviors produce usable telemetry and response. Agree on scope and safety, then turn gaps into tested detection or control changes rather than merely counting techniques executed.

Why is a fully colored ATT&CK coverage map insufficient evidence?

A mapped rule may lack data, be disabled, or fail on real variants. Link claimed coverage to telemetry availability, tested cases, alert quality, and response capability for the relevant environment.

How should security telemetry retention be selected?

Balance investigation horizons, data sensitivity, access needs, storage cost, and applicable policy. Document searchable versus archived periods and test retrieval; retaining everything indefinitely is not automatically more useful or appropriate.

When is it reasonable to close a security investigation?

The evidence supports a documented disposition, urgent risks are addressed, recovery is verified where needed, and remaining actions have owners. Preserve uncertainty and reopening triggers instead of claiming certainty beyond available telemetry.