The incident response lifecycle

What a defender does, in order, from the first alert to the lesson learned.

← Training·Level 1 of 9 · Shailaputri — the steady foundation·Foundation·about 12 minutes

1Four phases

NIST SP 800-61 Rev. 2, the most widely used incident handling guide, describes four phases: Preparation; Detection and Analysis; Containment, Eradication and Recovery; and Post-Incident Activity.

They loop. What you learn after one incident becomes preparation for the next. Rev. 3 (2025) reorganises this around the NIST Cybersecurity Framework 2.0 functions, but the work is the same.

2Detection is not diagnosis

An alert tells you something looked unusual. Analysis decides whether it is an incident, what caused it and how far it reached. Most of the time spent in an incident is here, because signals arrive in different tools at different times.

Write down what you know and how you know it. An unsupported conclusion is the most expensive mistake in incident response, because everything after it acts on it.

3Contain before you clean

Containment limits the damage: isolate a host, disable an account, block an address. Eradication removes the cause, and recovery restores normal service.

Every containment action should say how to undo it and what 'fixed' will look like, before it runs. That is how you avoid an outage you caused yourself.

Test what you learned

5 questions · pass mark 80% · every answer explains itself after you submit.

1.In NIST SP 800-61 Rev. 2, which phase comes directly after Detection and Analysis?
2.An alert fires for unusual sign-ins. What is the next step?
3.Why decide the rollback before running a containment action?
4.What is the main output of Post-Incident Activity?
5.Which is the most dangerous mistake during analysis?

Next level · BrahmachariniReading MITRE ATT&CK