Group 03: SOC and Incident Response

What is a Security Operations Center?

A team and function responsible for monitoring, detecting, investigating, and responding to cybersecurity threats.

What is a security event?

A recorded activity that may be normal, suspicious, or malicious.

What is a security alert?

A notification generated when activity matches detection logic or appears suspicious.

What is an investigation?

The process of gathering and analyzing evidence to determine what happened, whether it is malicious, and what action is required.

What is a security incident?

A confirmed or suspected event that threatens confidentiality, integrity, or availability and requires a coordinated response.

What is triage?

The initial review of an alert to determine validity, severity, scope, urgency, and required action.

What is a true positive?

An alert that correctly identifies malicious or unauthorized activity.

What is a false positive?

An alert that identifies legitimate activity as suspicious or malicious.

What is a false negative?

Malicious activity that occurs without being detected.

What is the difference between severity and priority?

Severity describes potential impact, while priority determines the order in which the issue should be handled based on severity, urgency, exposure, and business context.

What are the major incident-response phases?

Preparation, detection and analysis, containment, eradication, recovery, and lessons learned.

What is containment?

Limiting attacker access, preventing further damage, and stopping the spread of an incident.

What is eradication?

Removing malware, persistence mechanisms, unauthorized accounts, and the root cause of compromise.

What is recovery?

Safely restoring systems and operations while monitoring for recurrence.

What is root-cause analysis?

Determining how an incident occurred and what underlying weakness allowed it.

What is incident scope?

Every affected user, system, application, account, data source, and relevant time period.

When should an alert be escalated?

When activity may be malicious, involves privileged accounts or critical systems, requires containment, has unclear scope, or exceeds the analyst’s authority.

What should an investigation note contain?

Alert summary, affected entities, timeline, evidence reviewed, queries performed, findings, conclusion, actions taken, and recommended follow-up.

Why is evidence preservation important?

Evidence may be required to determine scope, support legal or compliance needs, validate conclusions, and conduct lessons learned.

What is chain of custody?

Documentation showing who collected, handled, transferred, stored, and examined evidence.

What is an incident playbook?

A documented response approach for a specific type of incident, such as phishing, malware, or account compromise.

What is the difference between containment and remediation?

Containment limits immediate damage, while remediation corrects the weakness or condition that allowed the incident.

Why should benign investigations still be documented?

Documentation supports auditing, future detection tuning, knowledge sharing, and consistent analyst decisions.

How should uncertainty be communicated?

Clearly separate confirmed facts, likely explanations, assumptions, and unresolved question