Detection and response¶

How a team notices something is wrong and what it does next: logging, detection engineering, triage, incident response, forensics and the lessons loop. Every other control fails sometimes; this is the part that limits the damage.

flowchart LR
  LOG[Collect:<br/>logs, endpoint, cloud audit] --> DET[Detect:<br/>rules, alerts, threat intel]
  DET --> TRI[Triage:<br/>real or noise?]
  TRI --> RESP[Respond:<br/>contain, eradicate, recover]
  RESP --> LEARN[Lessons learned]
  LEARN -.better rules and runbooks.-> DET

The loop this topic covers. Each stage has a concept page below, and the lessons stage feeds back into detection.

Learn¶

• Logging and detection - what to log, SIEM, detection engineering
• Endpoint security: EDR and XDR - behavioural detection, isolation and cross-source incidents
• MITRE ATT&CK for defenders - reading the matrix and measuring detection coverage
• Threat intelligence basics - IOCs vs TTPs, sources, TLP and SOC use
• Vulnerability management - CVE, CVSS, EPSS, KEV and patch SLAs
• Incident response basics - the NIST lifecycle, runbooks, postmortems
• Digital forensics basics - evidence handling, chain of custody, volatile-first order
• Backup and ransomware resilience - 3-2-1-1-0, immutability, restore testing
• CSPM and CNAPP explained - posture findings and attack paths in the cloud

Run an incident¶

The playbooks are short, defensive runbooks. Each follows detect, contain, eradicate, recover, lessons learned.

• Leaked cloud access key
• Phishing report triage
• Suspicious OAuth app grant
• Ransomware, the first hour
• Lost or stolen laptop
• Publicly exposed storage bucket

Compare and reference¶

• Security tools comparison - GuardDuty vs Defender vs SCC
• Architecture pattern: Centralized security logging and SIEM
• Architecture pattern: SOC detection and response pipeline
• Case study: SolarWinds 2020 - a compromise found by a customer, not a tool
• Case study: Log4Shell 2021 - responding to a critical dependency vulnerability
• Case study: MOVEit 2023 - mass exploitation of a file transfer product
• Case study: Change Healthcare 2024 - ransomware and the cost of recovery
• Case study: Colonial Pipeline 2021 - an IT-to-OT shutdown decision
• Case study: MGM Resorts 2023 - help desk impersonation and shutting down to contain
• Interview prep: SOC analyst

Build¶

• Centralized logging and alerting - cloud audit logs into a locked archive and tested alerts

Certify¶

• CompTIA CySA+ - analyst skills: detection, response, vulnerability management
• Microsoft Security Operations Analyst (SC-200) - Sentinel, Defender XDR and KQL
• AWS Security Specialty (SCS-C03) - detection and incident response domains
• GCP Cloud Security Engineer - security operations
• The career-track view: SOC analyst roadmap