MODULE 9: Incident Detection & Response

Lesson 1: What is a Security Incident?

1. Definition

A security incident is any event that:

• Violates security policies
• Threatens confidentiality, integrity, or availability
• Results from unauthorized access
• Indicates potential compromise

2. Examples of Security Incidents

1. Malware Infection

• Ransomware
• Spyware
• Worms
• Trojans

2. Unauthorized Access

• Login from unknown country
• Privilege escalation
• Account takeover

3. Data Breach

• Downloading large amount of data
• Unencrypted data exposed publicly

4. Network Attacks

• DDoS
• MITM
• Brute force attempts

5. Insider Threats

• Employee stealing data
• Accessing restricted files

6. System Failure

• Server outage
• Misconfigured firewall exposing services

3. Incident Categories

• Low (minor policy violations)
• Medium (suspicious activity, phishing)
• High (malware, compromised accounts)
• Critical (data breach, ransomware, major outage)

Lesson 2: SOC Operations (Tier 1–3 Analysts)

A Security Operations Center (SOC) monitors, detects, and responds to cyber threats.

SOC Structure

Tier 1 — Alert Monitoring (Entry-Level)

Responsibilities:

• Monitor SIEM alerts
• Review suspicious activity
• Escalate real threats
• Close false positives

Skills:

• Log analysis
• Basic networking
• Understanding of common attacks

Tier 2 — Incident Responder (Intermediate)

Responsibilities:

• Deep investigation
• Analyze malware behavior
• Review compromised accounts
• Contain threats
• Work on real incidents

Skills:

• EDR usage
• Network forensics
• Malware analysis
• Threat hunting

Tier 3 — Threat Hunter / SOC Expert (Advanced)

Responsibilities:

• Proactively search for threats
• Reverse engineer malware
• Improve detection rules
• Analyze advanced persistent threats (APTs)

Skills:

• Cyber threat intelligence
• Advanced forensics
• Scripting (Python, PowerShell)

SOC Manager

Manages:

• SOC team
• Incident reports
• Policies
• Compliance

Lesson 3: SIEM Tools (ELK, Splunk, Wazuh, Sentinel)

SIEM = Security Information and Event Management

SIEM collects logs from:

• Firewalls
• EDR
• Servers
• Applications
• Cloud services
• Authentication systems

Then analyzes them to detect suspicious behavior.

Popular SIEM Tools

1. Splunk Enterprise Security

• High performance
• Expensive
• Used by global enterprises
• Very strong analytics

2. Microsoft Sentinel

• Cloud-native SIEM
• Works with Azure, M365
• AI-based detection
• Cheaper than Splunk

3. Wazuh

• Free & open-source
• Great for mid-sized companies
• Integrates with Elastic Stack

4. ELK / Elastic Security

• Log collecting + analytics
• Powerful dashboards
• Widely used

Why SIEM Is Important

SIEM helps security teams:

• Detect threats quickly
• Investigate security incidents
• Correlate logs
• Create alerts
• Comply with regulations

Common SIEM Alerts

• Multiple failed login attempts
• Login from unusual countries
• Sudden privilege escalation
• Suspicious PowerShell execution
• Data exfiltration activity
• Inactive user account suddenly active
• Malware detection from EDR

Lesson 4: Incident Response Lifecycle

Incident Response (IR) is a step-by-step method used by SOC teams to handle attacks.

1. Preparation

• Create policies
• Train employees
• Configure monitoring tools
• Create IR team roles
• Set up backups

2. Identification

Detect the incident using:

• SIEM alerts
• EDR alerts
• Firewall logs
• User reports
• Network anomalies

Goal:
Confirm whether an incident actually happened.

3. Containment

Short-term:

• Isolate infected machine
• Block attacker IP
• Disable compromised account
• Stop malicious processes

Long-term:

• Apply patches
• Block attack vector
• Improve firewall rules

Goal:
Stop the attack from spreading.

4. Eradication

Remove the root cause:

• Delete malware
• Remove backdoors
• Clean registry entries
• Remove malicious accounts
• Patch vulnerabilities

Goal:
Ensure attacker cannot return.

5. Recovery

• Restore systems
• Recover data from backups
• Monitor systems closely
• Validate normal functioning

Goal:
Return to business operations safely.

6. Lessons Learned (Post-Incident Review)

Document:

• What happened
• Root cause
• Impact
• Timeline
• Improvements needed

Goal:
Prevent similar incidents in the future.

Lesson 5: Threat Hunting Basics

Threat hunting = actively searching for hidden threats before they cause damage.

Unlike SIEM alerts, threat hunting is manual + proactive.

1. Why Threat Hunting Is Needed

Attackers may:

• Bypass security tools
• Hide inside the network
• Use “living off the land” tools (PowerShell, WMI)
• Use legitimate accounts

Automated tools may miss these.

2. Threat Hunting Methods

1. Hypothesis-Based Hunting

Example hypothesis:
“Attackers may be using PowerShell to download malicious scripts.”

Hunter checks:

• PowerShell logs
• Command history
• Suspicious network connections

2. IOC Hunting (Indicators of Compromise)

IOCs include:

• Malicious IP addresses
• File hashes
• Domains used in attacks
• Unusual processes

Tools check for these across the organization.

3. Behavioral Hunting

Looks for unusual actions:

• User logs in at 3 AM
• Large file transfers
• Unknown scripts running
• Lateral movement between servers

3. Tools Used for Threat Hunting

• EDR (CrowdStrike, SentinelOne, Defender)
• SIEM (Splunk, Sentinel, Elastic)
• Threat Intel (VirusTotal, IBM X-Force, AlienVault)
• Log analyzers

4. Skills Required for Threat Hunting

• Strong understanding of OS (Windows/Linux)
• Networking fundamentals
• Scripting (Python, PowerShell)
• Attack techniques (MITRE ATT&CK)
• Log analysis

Module 9 Summary

Students now understand:

• Exactly what qualifies as a security incident
• How SOC teams operate (Tier 1, 2, 3)
• How SIEM tools detect attacks
• The entire incident response lifecycle
• How threat hunting identifies hidden attackers

This module answers the question:
“How do cybersecurity teams detect, investigate, and stop attacks in real time?”