4.8 Explain appropriate incident response activities

Breakdown 1 — Events vs. incidents (class)

An event is anything observable (a login, a blocked packet). An incident is an event (or set of events) that actually violates policy or harms C/I/A. Event evaluation sorts them — and can be wrong:

• False positive — benign event mistaken for a problem (wastes time; too many → alert fatigue).
• False negative — real problem mistaken for benign (the dangerous miss).

	Alarm raised	No alarm
Real problem	True positive — problem detected	False negative — missed incident (BAD)
No problem	False positive — wrong alarm (tolerable; tune it)	True negative — correctly quiet

★ Starred in your notes (Day 5): dd tool → forensic image of a hard drive; use a write blocker (prevents writes, makes the source read-only).

Breakdown 2 — The IR process (memorize the order)

Phase	What happens	Keywords
1 Preparation	Policies, IR plan, playbooks, tools, trained team, contacts, backups	"before anything happens"
2 Detection	Notice the incident (SIEM alert, user report, threat hunt)	"identify"
3 Analysis	Scope it: what, how, which systems, is it real? Triage severity	"determine impact"
4 Containment	Stop the bleeding — isolate hosts, disable accounts, block IPs; short-term vs. long-term	"limit damage"
5 Eradication	Remove the cause — delete malware, close the vulnerability, rebuild	"remove"
6 Recovery	Restore systems/data to production, monitor closely for reinfection	"return to normal"
7 Lessons learned	Post-incident review; update plan/controls; root cause analysis	"improve"

From class — NIST's 4-phase version of the same cycle: Preparation → Detection & Analysis → Containment, Eradication & Recovery (loops back to detection as you learn more) → Post-incident activity. CompTIA splits the middle phases out into the 7 above; the order is the same. Root cause analysis → find the underlying cause, not just the symptom.

Training everyone on their role; testing with tabletop exercises (discussion) and simulations (hands-on drills). Threat hunting = proactively searching for compromise before an alert fires, using intel and hypotheses (class: threat-hunting tactics — AI can help sift the data).

Breakdown 3 — Attack models used in analysis (class: know them)

Cyber Kill Chain: Reconnaissance → Weaponization → Delivery → Exploitation → Installation → Command & Control → Actions on Objectives. Detecting early (recon/delivery) is cheaper than late (actions).

Diamond Model: Adversary · Infrastructure · Capability · Victim — link the four to pivot from one indicator to the others.

MITRE ATT&CK: catalog of tactics/techniques (initial access, persistence, privilege escalation, lateral movement, exfiltration…).

Breakdown 4 — Digital forensics

Term	Meaning
Legal hold	Preserve all relevant data (suspend deletion/retention) when litigation is anticipated
Chain of custody	Documented who handled evidence, when, why — unbroken, or it's inadmissible; hash checking proves the copy matches the original (class)
Acquisition	Collect evidence in order of volatility: CPU/registers → RAM/cache → network state/processes → disk → backups/archives → printouts. Memory dumping first, then a bit-for-bit disk image with dd ★ through a write blocker; hash the image
Preservation	Write blockers, hashed copies, secure storage; work on copies
Reporting	Findings, methods, timeline — in plain language, reproducible
E-discovery	Producing electronic records for legal proceedings — must be done in a way that is legal (class); if legal requires it, files must be retained longer (retention + legal hold)

Exam tip: "First step after confirming ransomware on a host" → containment (isolate). "Analyst reviewed the incident and updated the playbook" → lessons learned. "Which should be collected first?" → RAM (most volatile). "Evidence thrown out in court" → broken chain of custody. "Lawsuit is likely — don't delete emails" → legal hold. "Proactively look for attackers without an alert" → threat hunting.

Quick self-check

• Order of the seven IR phases?
• Containment vs. eradication? (Stop spread vs. remove cause.)
• Most volatile evidence? (CPU registers/RAM.)