Security Operations · Topic 13 of 14
Incident Response Activities
Security+ incident response: preparation, identification, investigation, containment, negotiation, recovery, notification and post-incident review.
- 5 min
- Includes a diagram
- The activities are preparation, identification, investigation, containment, negotiation, eradication and recovery, notification and post-incident.
- Preparation covers training, testing, tabletop exercises, playbooks, simulation and roles.
- Identification comes from detection, internal and external advisories and threat hunting.
What it is
An incident is an event that harms, or threatens, the confidentiality, integrity or availability of systems or data. Incident response (IR) is the organized way of handling it.
A clear process lets a team act calmly and in the right order under pressure. The activities below are a core exam topic.
How it works
Preparation
A plan is only useful if people know it. Preparation sets up the plan, the tools, the contact lists and the communication rules before anything happens.
| Element | Meaning |
|---|---|
| Training | Staff learn their part in the plan and how to use the tools |
| Testing | The plan, tools and backups are checked to see that they work |
| Tabletop exercises | The team talks through a scenario step by step, with no systems touched |
| Playbooks | Step by step instructions for a type of incident, such as ransomware or a lost laptop |
| Simulation | A more realistic practice that uses real tools and actions in a controlled way |
| Roles | Defined responsibilities, such as incident lead, technical analysts, communications, legal and management |
Exercises reveal gaps, such as missing contacts or unclear authority, while the cost of a mistake is low.
Identification
| Source | Meaning |
|---|---|
| Detection | Alerts from monitoring tools, or reports from users |
| Internal advisory | A notice from inside the organization, such as the security team warning of a new attack seen in its systems |
| External advisory | A notice from outside, such as a vendor bulletin, a government agency or an information sharing group |
| Threat hunting | A proactive search for attackers who have not triggered any alert |
Threat hunting starts with a hypothesis, for example that an attacker is using a certain technique, and looks through logs for traces. Hunting starts without an alert, while detection starts after one.
Investigation
| Element | Meaning |
|---|---|
| Digital forensics | Collecting and examining digital evidence so that it can be trusted |
| Chain of custody | A record of who handled each piece of evidence, when and why |
| E-discovery | Finding and producing electronic information for legal matters |
| Preservation | Keeping evidence unchanged and protected from deletion |
Investigation confirms what happened, which systems and data are involved and how serious it is. Preserve evidence before systems are wiped or rebuilt.
Containment
Containment limits the spread. Quarantine or isolation cuts a host off from the network, often through the endpoint detection and response (EDR) tool or by moving it to a separate network. Accounts may be disabled and malicious addresses blocked.
Containment comes before eradication. If you remove the cause before stopping the spread, the attacker may react or move on.
Negotiation
Negotiation applies when attackers demand payment, as in ransomware or data extortion. It is handled by authorized people, often specialists, with legal advice and usually law enforcement involved. Paying does not guarantee that data is returned or deleted, and in some cases payment can break sanctions laws.
Eradication and recovery
Eradication removes the cause, such as malware, attacker accounts and the vulnerability used. Recovery restores systems from known clean backups, resets credentials and returns services to normal, then watches closely for the attacker's return.
Notification and external reporting
| Audience | Meaning |
|---|---|
| Stakeholders | Management, staff and owners who need accurate updates |
| Customers | People whose data or service was affected |
| Law enforcement | Police or national agencies, especially for crimes such as extortion |
| Mandatory | Reports required by law, regulation or contract, often within fixed deadlines |
For example, the General Data Protection Regulation (GDPR) requires notifying the supervisory authority of a qualifying personal data breach within 72 hours of becoming aware of it. Only authorized people should speak for the organization.
Post-incident
| Activity | Meaning |
|---|---|
| Lessons learned | The team reviews what worked and what did not, and updates the plan |
| Root cause analysis | Finding the underlying reason, such as a missing patch or a weak process, not just the symptom |
| Post-incident reporting (PIR) | A written report of the timeline, impact, actions taken and improvements |
How the exam asks about this
- "The team talks through a ransomware scenario around a table." -> A tabletop exercise.
- "An infected laptop must be cut off from the network now." -> Containment by quarantine or isolation.
- "A vendor bulletin warns of a flaw being exploited." -> An external advisory during identification.
What to remember for the exam
- The activities are preparation, identification, investigation, containment, negotiation, eradication and recovery, notification and post-incident.
- Preparation covers training, testing, tabletop exercises, playbooks, simulation and roles.
- Identification comes from detection, internal and external advisories and threat hunting.
- Investigation needs forensics, chain of custody, e-discovery and preservation.
- Containment limits the spread and comes before eradication.
- Negotiation is for extortion and needs legal and law enforcement input.
- Notification can be mandatory by law, with fixed deadlines.
- Post-incident covers lessons learned, root cause analysis and the PIR.
A tabletop exercise is a discussion. A simulation uses real tools in a controlled way.
Common mistakes
Wiping a system before collecting evidence. Evidence may be needed for analysis or legal action, so preserve it first.
Skipping lessons learned. Without it, the same mistake repeats.
Mixing up eradication and recovery. Eradication removes the cause. Recovery brings systems back into service.
Missing a mandatory deadline. Legal reporting duties run from the time the breach is known.
Communicating freely during an incident. Uncontrolled statements can mislead people or damage legal position.
Do not power off a compromised machine without thinking. Data in memory is lost, and the attacker may notice the response.
Check yourself
Which activity comes first after an incident is confirmed and scoped?
Containment, to limit the spread before the cause is removed.
How does threat hunting differ from detection?
Hunting is a proactive search without an alert, while detection begins with an alert or report.
What is root cause analysis?
Finding the underlying reason an incident happened so it can be fixed and not repeated.
Topic 13 of 14 in Security Operations
Test yourself on Security Operations
The full CompTIA Security+ SY0-801 question bank has 998 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.