Chapter 5 of 5 · Cisco CCST 100-160 Cybersecurity
Incident Handling
SIEM and SOAR monitoring, forensics, compliance reporting and the response lifecycle.
- 4topics
- 20 minfast track
- 3diagrams and exhibits
Topics in this chapter
Take them in order, or jump to the one you need.
- 1SIEM, SOAR and Security Event MonitoringLearn what SIEM and SOAR do, how packet captures and logs reveal incidents, how to spot suspicious events and when to escalate to…5 min
- 2Digital Forensics, Kill Chain, ATT&CK and Evidence HandlingLearn the Cyber Kill Chain, MITRE ATT&CK, the Diamond Model, TTPs, sources of digital evidence and how to preserve evidence and…Diagram5 min
- 3Compliance Frameworks and Breach ReportingLearn how GDPR, HIPAA, PCI DSS, FERPA and FISMA affect incident handling, and why reporting and notification requirements matter…5 min
- 4Incident Response Policy, Plan and LifecycleLearn the elements of an incident response policy, plan and procedures, and the NIST SP 800-61 lifecycle stages from preparation…Diagram5 min
About this chapter
What this chapter covers
This chapter is about what happens when prevention fails and an attack, or a possible attack, is under way.
It starts with the monitoring that spots trouble, then covers how evidence is gathered and attackers are studied. It also explains the legal and reporting duties that follow a breach, and the structured process of incident response.
The pages are written for beginners and define each acronym when it first appears.
How the topics fit together
The topics follow the order of a real incident, from the first alert to the final review.
The pages connect like this:
- Monitoring collects events, raises alerts and decides when to escalate.
- Forensics explains how evidence is gathered, handled and linked to attacker behaviour, using models such as the Kill Chain.
- Compliance covers the rules on telling regulators and affected people.
- The response lifecycle is the framework that ties detection, containment, recovery and review together.
The same incident touches all four pages. A single phishing breach may be spotted by a SIEM, investigated as evidence, reported under a regulation and reviewed afterwards.
How to use these pages
Each topic page has the same five sections, so you can skim for what you need.
- What it is: the idea in plain words.
- How it works: the mechanism, with diagrams and tables.
- What to remember for the exam: the facts to memorise.
- Common mistakes: the classic traps.
- Check yourself: three questions with short answers.
This chapter contains several ordered lists, such as the Kill Chain stages and the response lifecycle. Practise reciting them in order, and try to give one example for each step.
If you can, take a short news story about a breach and map it to the stages. Ask when it was detected, what was contained, who had to be told and what should be learned.
Ready for more practice?
The full Cisco CCST 100-160 Cybersecurity question bank has 864 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Cisco. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.