Chapter 10 — The incident response process
Lesson map
Lesson 10 published. Map, example, EX037.
flowchart TD
N0["Learning outcomes"]
N1["10.1 The life cycle"]
N2["10.2 Roles"]
N3["10.3 The record"]
N4["10.4 Severity levels"]
N5["10.5 Closure"]
N6["10.6 Lessons"]
N7["Evidence handling"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX037"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["10.1 The life cycle"]
N2["10.2 Roles"]
N3["10.3 The record"]
N4["10.4 Severity levels"]
N5["10.5 Closure"]
N6["10.6 Lessons"]
N7["Evidence handling"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX037"]
[Learning outcomes]
|
v
[10.1 The life cycle]
|
v
[10.2 Roles]
|
v
[10.3 The record]
|
v
[10.4 Severity levels]
|
v
[10.5 Closure]
|
v
[10.6 Lessons]
|
v
[Evidence handling]
|
v
[Worked example] --> [Exercise EX037]
Learning outcomes
You will (1) describe the incident response life cycle in NIST SP 800-61r3; (2) explain roles during an incident; (3) open, run and close an incident record; (4) link response to CSF 2.0.
10.1 The life cycle
NIST SP 800-61 Revision 3 (Nelson et al., 2025) places incident response within CSF 2.0: preparation through Govern, Identify and Protect; detection and analysis through Detect; response through Respond; and recovery through Recover, with lessons feeding improvement. For INC-0417, preparation had gaps, such as no MFA on the portal and a shared account. Detection and analysis covered 09:04 to 09:40, response the 09:52 account disable, and recovery the named accounts created for the gardeners that day. The lessons then fed back into preparation through the MFA plan and the new detection rule.
10.2 Roles
An incident lead coordinates, analysts investigate, IT acts on systems, communications handles messages and a manager approves big decisions. In a small SOC one person may hold several roles, but each must be named. In INC-0417 Carlos was analyst and, for a minor incident, effectively lead, while IT created named accounts and the IT manager approved the MFA plan. Naming each role in the record, even when one person holds several, stops tasks being assumed by everyone and done by no one.
10.3 The record
The incident record holds a timeline, decisions, evidence references, actions and owners. Carlos opened INC-0417 for the parks01 compromise. INC-0417's record holds the timeline from 09:04 to 10:30, the decision to disable parks01 at 09:52, references to the portal and share logs, and the owners of each lesson. Anyone picking it up later can see what happened and why each step was taken. Evidence references point to copies saved in the case folder with time stamps, not to searches in the SIEM alone.
10.4 Severity levels
Northgate uses three levels: minor (one account, no data), significant (data exposure or several systems) and major (service disruption). INC-0417 is minor. INC-0417 is minor because one shared account was affected and the share's audit log shows no downloads. Had files been downloaded, it would have become significant, since data exposure triggers that level. The level decides who is told and how quickly, including the data protection officer. The level is reviewed whenever new evidence appears, so it can rise or fall during the case.
10.5 Closure
An incident closes when containment is confirmed, systems are restored and lessons are recorded. For INC-0417, containment was confirmed when parks01 was disabled and no further logons came from 203.0.113.80. Restoring service meant named accounts for the gardeners, and lessons were recorded with the IT manager as owner. Closing before all three would leave loose ends that nobody tracks. Aisha checks all three conditions before INC-0417 is marked closed. The INC-0417 record shows the date on which each of the three conditions was met.
10.6 Lessons
A short review asks what happened, what went well, what to change, with owners and dates. INC-0417's review produced two changes, named accounts and MFA within two weeks, each with an owner. The review asks what went well too, such as linking the 09:04 and 09:09 alerts quickly. Without owners and dates, lessons tend to stay as notes rather than become changes. The INC-0417 review is held within a week of closure, while details are still fresh in everyone's memory and notes.
Evidence handling
Logs and screenshots used in an incident are saved to a case folder with time stamps and who saved them, so findings can be checked later. Original logs are left in the SIEM; copies go to the folder. If an incident might lead to disciplinary or legal action, the information governance lead is told early so evidence is kept properly from the start.
Worked example
INC-0417 timeline: 09:04 guessing; 09:09 parks01 logon; 09:15 file-share browsing ends; 09:40 Carlos confirms tablet idle; 09:52 account disabled; 10:30 MFA plan agreed. Lessons: replace shared accounts with named accounts for gardeners; MFA on portal within two weeks; owner: IT manager.
Synthetic case. The incident record is invented.
Errors and limits
Real incidents rarely follow the stages in order; the cycle is a guide.
Exercises
- EX037 — Life cycle link. How does SP 800-61r3 relate to CSF 2.0? Rubric: 3 = maps response to CSF functions; 2 = partial; 1 = vague; 0 = none.
- EX038 — Five roles. Name the roles in an incident. Rubric: 3 = lead, analysts, IT, communications, manager; 2 = four; 1 = two; 0 = none.
- EX039 — Severity. Why is INC-0417 minor? Rubric: 3 = one account, no data taken; 2 = partial; 1 = vague; 0 = none.
- EX040 — Lessons. Name two lessons from INC-0417. Rubric: 3 = named accounts for gardeners; MFA on portal; 2 = one; 1 = vague; 0 = none.
Synthesis
A clear process, named roles and a good record carry an incident from alert to lessons.
Continue studying — chapter 10 of 18
← Chapter 09 (draft) · Course chapter index · Chapter 11 (draft) →