SOC incident response technical steps using NIST framework
1. Preparation
2. Detection and Analysis
- Use automated monitoring tools.
- Review logs for irregular patterns.
- Set up alerts for known IoCs.
- Conduct regular vulnerability scans.
- Ensure real-time monitoring of critical assets.
- Integrate threat intelligence feeds.
- Stay updated on emerging threats.
- Share intelligence with peer organizations.
- Use threat models to anticipate attacks.
- Correlate threat data with internal logs.
- Prioritize alerts based on risk.
- Investigate anomalies using forensic tools.
- Consult with incident response team.
- Confirm if the alert aligns with known threats.
- Document the analysis process thoroughly.
- Record initial detection details.
- Outline impacted systems and data.
- Gather evidence from affected systems.
- Create a timeline of events.
- Establish a communication plan for stakeholders.
- Use a standardized classification system.
- Assess the potential business impact.
- Determine the incident's urgency.
- Review historical incident data for context.
- Assign a classification level accordingly.
3. Containment, Eradication, and Recovery
- Isolate infected systems from the network.
- Disable compromised user accounts.
- Block malicious IP addresses and domains.
- Implement firewall rules to restrict access.
- Notify relevant stakeholders of the containment measures.
- Assess the extent of the compromise.
- Implement additional security controls.
- Create a detailed action plan for system recovery.
- Schedule regular updates and reviews of the containment strategy.
- Communicate the plan to all team members involved.
- Conduct a thorough investigation of logs and alerts.
- Utilize forensic tools to analyze the attack vector.
- Document findings related to the root cause.
- Remove malicious software and backdoors.
- Ensure no remnants of the threat remain in the environment.
- Restore systems from clean backups.
- Apply all necessary security patches and updates.
- Reconfigure security settings to enhance protection.
- Monitor systems for unusual activity post-recovery.
- Re-enable services once verified as secure.
- Perform system functionality tests to verify operations.
- Conduct user acceptance testing with key stakeholders.
- Review system logs for any anomalies.
- Ensure compliance with security policies.
- Document the validation process and results.
Use in Manifestly