Incident Response · Topic 1 of 6
Incident Response and Its Phases
Learn what incident response is, how events, alerts and incidents differ, and the NIST and EC-Council incident handling phases for the CSA 312-39 exam.
- 5 min
- Includes a diagram
- An incident is a confirmed policy violation or imminent threat, not every alert.
- NIST four phases: preparation; detection and analysis; containment, eradication and recovery; post incident activity.
- EC-Council nine stages run from preparation to post incident activities, with triage before notification and containment.
What it is
Incident response (IR) is the organized way a SOC and its incident response team prepare for, detect, contain, remove and recover from security incidents, and then learn from them. Its goals are to limit damage, restore normal service quickly, preserve evidence and stop the same incident from happening again.
An event is any observable occurrence, such as a logon or a connection. An alert is a notice that a tool thinks an event is suspicious. An incident is a confirmed violation, or imminent threat of violation, of security policy that harms confidentiality, integrity or availability.
How it works
Why the SOC needs a defined process
A written IR policy and plan say what counts as an incident, who is on the computer security incident response team (CSIRT), who has authority to act, and how to communicate. Without it, analysts improvise, evidence is lost and containment is late.
The SOC usually detects and triages, while the IR team (sometimes Tier II and Tier III in the same SOC) leads containment and recovery. Legal, human resources, public relations and management join for serious cases.
| Role | Typical job in an incident |
|---|---|
| Tier I analyst | Monitors alerts, triages, opens the ticket, escalates |
| Tier II analyst or incident responder | Investigates scope, contains and coordinates eradication |
| Tier III analyst or threat hunter | Deep analysis, malware and forensic work, hunting |
| SOC manager or incident manager | Decides priority, approves risky actions, reports |
| Legal, HR, PR | Notification duties, employee issues, public statements |
Severity and priority
Incidents are classified by category (malware, unauthorized access, denial of service, data breach, insider misuse) and rated by severity, based on business impact and urgency. Priority decides who works it first and how fast escalation happens.
Key timing measures are mean time to detect (MTTD), mean time to respond (MTTR) and, in many SOCs, mean time to contain. Shorter times mean less damage.
NIST SP 800-61 lifecycle
NIST SP 800-61 Rev. 2 describes the classic four phase lifecycle that most exam questions use.
| NIST phase | What happens |
|---|---|
| Preparation | Policy, plan, team, tools, contacts and training before any incident |
| Detection and analysis | Alerts and reports are validated, scoped and prioritized |
| Containment, eradication and recovery | Stop the spread, remove the cause, restore service |
| Post incident activity | Lessons learned, report, improve controls and the plan |
Detection and analysis and the containment phase loop back to each other, because new findings during containment can widen the scope. NIST published Rev. 3 in April 2025, which maps incident response to the Cybersecurity Framework 2.0 functions, but the four phases above remain the common teaching model.
EC-Council incident handling and response stages
EC-Council expands the same work into nine stages. Learn their order, because questions often ask what comes next.
| Stage | Purpose |
|---|---|
| 1. Preparation | Build the IR capability: plan, team, tools, playbooks |
| 2. Incident recording and assignment | Log the incident in the ticketing system and assign an owner |
| 3. Incident triage | Analyze, validate, classify and prioritize |
| 4. Notification | Inform management, stakeholders and, where required, regulators |
| 5. Containment | Stop the incident from spreading, for example isolate a host |
| 6. Evidence gathering and forensic analysis | Collect and examine evidence to learn what happened |
| 7. Eradication | Remove the root cause: malware, rogue accounts, the exploited weakness |
| 8. Recovery | Restore systems from clean sources, verify and monitor |
| 9. Post incident activities | Documentation, impact assessment, lessons learned, policy updates |
Containment strategies
Short term containment stops the damage now, such as isolating an endpoint or blocking an IP address. Long term containment keeps the business running while a clean fix is prepared, such as moving a service to a clean segment.
The choice depends on the need to preserve evidence, service availability, resources needed and how long the measure must last. Eradication comes before recovery, because restoring a host that still holds the attacker reopens the incident.
A worked example
A SIEM raises an alert for 40 failed logons (event ID 4625) followed by a success (4624) on a file server. The Tier I analyst confirms it is not a scheduled task, records the ticket and escalates it as a likely brute force compromise.
The responder notifies the SOC manager, disables the account and isolates the server, then captures memory and logs. After removing a dropped backdoor and resetting credentials, the server returns to service under extra monitoring, and the review adds account lockout to the plan.
How the exam asks about this
- "Which incident handling stage logs the incident and gives it an owner?" → Incident recording and assignment.
- "In which stage are incidents validated, classified and prioritized?" → Incident triage.
- "Which NIST SP 800-61 phase includes writing a lessons learned report?" → Post incident activity.
What to remember for the exam
- An incident is a confirmed policy violation or imminent threat, not every alert.
- NIST four phases: preparation; detection and analysis; containment, eradication and recovery; post incident activity.
- EC-Council nine stages run from preparation to post incident activities, with triage before notification and containment.
- Containment before eradication, eradication before recovery.
- MTTD and MTTR measure how fast the SOC detects and responds.
Do not confuse triage with containment. Triage decides whether it is real and how urgent; containment is the first action that limits the damage.
Common mistakes
Treating every alert as an incident. Most alerts are false positives or benign; only validated ones enter the full incident process.
Recovering before eradicating. Restoring a system while the persistence mechanism remains lets the attacker straight back in.
Skipping post incident work. Without lessons learned the same gap is exploited again, and the plan never improves.
Check yourself
What is the difference between an alert and an incident?
An alert is a tool flagging something suspicious; an incident is a confirmed violation or imminent threat to security policy.
Which EC-Council stage comes right after incident triage?
Notification, where management and other required parties are informed.
Why does eradication come before recovery?
Recovering a host that still contains the threat lets the incident restart.
Topic 1 of 6 in Incident Response
Test yourself on Incident Response
The full EC-Council 312-39 question bank has 700 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by EC-Council. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.