Security Operations · Topic 12 of 13
Incident Response Process
Security+ incident response: stages from preparation to lessons learned, tabletop and simulation exercises, root cause analysis and threat hunting.
- 4 min
- Includes a diagram
- The stages are preparation, detection, analysis, containment, eradication, recovery and lessons learned.
- Containment limits the spread and comes before eradication.
- Recovery restores systems, and monitoring continues afterward.
What it is
An incident is an event that harms, or threatens, the confidentiality, integrity or availability of systems or data. Incident response (IR) is the organized way of handling it.
A clear process lets a team act calmly and in the right order under pressure. The stages below are a core exam topic.
How it works
The stages
| Stage | What happens |
|---|---|
| Preparation | Write the plan, form the team, set up tools and train staff |
| Detection | Notice an event from alerts, users or monitoring |
| Analysis | Confirm that it is a real incident, find its scope and priority |
| Containment | Limit the spread, for example by isolating hosts or blocking accounts |
| Eradication | Remove the cause, such as malware, bad accounts or the vulnerability used |
| Recovery | Restore systems to normal, then monitor for repeat activity |
| Lessons learned | Review what happened and improve the plan |
Containment comes before eradication. If you remove the cause before stopping the spread, the attacker may react or move on. Short term containment stops damage fast, and long term containment keeps systems safe while they are being rebuilt.
Preparation, training and testing
A plan is only useful if people know it. Preparation includes defined roles, contact lists, tools and communication rules. Training and testing practice the plan before a real incident.
| Exercise | Description |
|---|---|
| Tabletop exercise | The team talks through a scenario step by step, with no systems touched |
| Simulation | A more realistic practice that may use real tools and actions |
Both reveal gaps, such as missing contacts or unclear authority, while the cost of a mistake is low.
Detection sources and priority
Incidents are noticed in several ways: a monitoring alert, a user report, a notice from a vendor or a message from a law enforcement agency. Every report should be logged and checked.
During analysis the team rates the incident by its effect on the business, such as the sensitivity of the data and the number of systems involved. Higher ratings get faster attention and wider escalation, and the rating can change as new facts appear.
Recovery in more detail
Recovery rebuilds trust in the systems. Restore from known clean backups, apply patches, reset credentials and confirm that the original weakness is closed. Then watch the systems closely for signs that the attacker has returned.
Root cause analysis
Root cause analysis looks beyond the symptom to the underlying reason an incident happened, such as a missing patch, a weak process or a configuration error. Fixing the cause prevents repeats. Fixing only the symptom does not.
Threat hunting
Threat hunting is a proactive search for attackers who have not triggered an alert. Hunters form a hypothesis, for example that an attacker is using a certain technique, and look through logs and data for traces. It uses threat intelligence and knowledge of attacker behavior.
Hunting is different from alert response. Response starts after a tool raises an alert, while hunting starts without one.
Communication
During an incident, communication follows the plan. Technical staff, management, legal and sometimes regulators or customers need correct and timely information. Only authorized people should speak for the organization.
What to remember for the exam
- The stages are preparation, detection, analysis, containment, eradication, recovery and lessons learned.
- Containment limits the spread and comes before eradication.
- Recovery restores systems, and monitoring continues afterward.
- Lessons learned feeds improvements back into preparation.
- A tabletop exercise is a discussion. A simulation is more hands on.
- Root cause analysis finds the underlying reason, not just the symptom.
- Threat hunting is proactive and does not wait for an alert.
- Roles, contacts and communication rules belong in the plan and are set during preparation.
In an order question, memorize the sequence: prepare, detect, analyze, contain, eradicate, recover, learn.
Common mistakes
Wiping a system before collecting evidence. Evidence may be needed for analysis or legal action, so preserve it first.
Skipping lessons learned. Without it, the same mistake repeats.
Mixing up eradication and recovery. Eradication removes the cause. Recovery brings systems back into service.
Treating a tabletop as a technical test. It checks people and process, not the systems.
Communicating freely during an incident. Uncontrolled statements can mislead people or damage legal position.
Do not power off a compromised machine without thinking. Volatile data in memory is lost, and the attacker may notice the response.
Check yourself
Which stage comes first after confirming that an incident is real?
Containment, to limit the spread before the cause is removed.
How does threat hunting differ from alert response?
Hunting is a proactive search without an alert, while response begins after an alert is raised.
What is the purpose of the lessons learned stage?
To review the incident and improve the plan, tools and training.
Topic 12 of 13 in Security Operations
Test yourself on Security Operations
The full CompTIA Security+ SY0-701 question bank has 848 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.