Overview — 10 key lines
1) Data collection: Centralize logs and telemetry from endpoints, network, cloud, and applications.
2) Normalization: Parse diverse log formats to enable correlation and search.
3) Enrichment: Add context like asset ownership, vulnerability status, and threat intel.
4) Triage: Prioritize alerts based on impact, confidence, and asset criticality.
5) Investigation: Use timelines, process lineage, and cross-source correlation to validate incidents.
6) Containment: Apply segmentation, blocklists, and credential resets to limit adversary movement.
7) Remediation: Coordinate patching, removal of persistence, and system rebuilds where required.
8) Hunting: Proactively search for stealthy activity using hypotheses and detections.
9) Automation: Implement SOAR playbooks for repetitive tasks to speed response.
10) Measurement: Track MTTD, MTTR, false positive rate, and analyst productivity.
Points explained
- Data collection: Broad visibility is the prerequisite — without it, many attacks remain invisible. Prioritize critical assets and expand coverage iteratively.
- Normalization: Use parsers to convert vendor-specific logs into structured fields so correlation rules and detection searches work predictably.
- Enrichment: Enrichment adds actionable context — e.g., asset risk score or user role — that powers accurate triage and reduces analyst time spent gathering data.
- Triage: Triage frameworks help junior analysts escalate high-confidence incidents while automating low-risk alerts to reduce noise.
- Investigation: Build timelines and reconstruct execution chains to determine root cause and scope; comprehensive logs and endpoint telemetry speed this up.
- Containment: Network segmentation, blocking C2, and account remediation are short-term controls to stop active compromise.
- Remediation: Reimage compromised hosts where needed, clean persistence mechanisms, and patch exploited vulnerabilities.
- Hunting: Use hypotheses derived from recent intelligence, anomaly detection, and unusual behaviors to uncover undetected intrusions.
- Automation: SOAR reduces manual work for enrichment, blocking, and notification — freeing analysts for higher-value tasks.
- Measurement: Carefully chosen KPIs drive investment decisions and operational improvements over time.