Exam objective 4.1 asks you to explain the intrusion analysis process and methodologies. This concept is the core of what a CyberOps associate does every day: turning raw alerts and logs into a clear story of what happened during a security breach. Understanding this process matters for your exam because it underpins multiple choice questions about incident response, detection, and investigation steps.
Jump to a section
A simple way to picture Introduction to Intrusion Analysis
Have you ever watched a security camera video after a package was stolen from your front porch?
You scroll back through the footage looking for the moment the thief appeared. You start by scanning quickly — you check the timestamp when you know the package was delivered, then you watch the delivery person drop it off and leave. But you don't stop there. You rewind a bit further to see if anyone was casing your house beforehand. You zoom in on a car that drove past slowly three times. Then you fast-forward to see what happened after the theft — did the thief run, drive away, or meet someone? You pause the video at key moments and take notes: the time, the person's clothing, the direction they went. You compare this footage to recordings from your neighbour's camera, and you notice the same person tried their door too. That's intrusion analysis. You are not just watching a video; you are examining evidence to understand a sequence of events, identify a threat, and piece together how and when the attack happened. In IT, an intrusion analyst does the same thing with digital evidence — logs, network traffic, and system alerts — to figure out how an attacker got in, what they did, and how to stop them next time.
Intrusion analysis is the process of examining digital evidence to determine if a security breach has occurred, how it happened, what systems were affected, and what actions to take next. Think of it as the investigative phase that happens after an alert fires — like when your home alarm goes off and you review the camera footage before calling the police.
The process is not random; it follows a structured methodology. The most common framework you need to know for 200-201 is the Cyber Kill Chain, developed by Lockheed Martin. This model breaks an attack into seven stages:
Reconnaissance: The attacker gathers information about the target, like scanning for open ports or researching employees on LinkedIn.
Weaponisation: The attacker couples malware with an exploit, for example attaching a malicious macro to a Word document.
Delivery: The attacker transmits the weapon to the target, often through a phishing email or a USB drop.
Exploitation: The weapon is triggered, exploiting a vulnerability to gain initial access.
Installation: The attacker installs a backdoor or persistent presence on the system.
Command and Control (C2): The compromised system communicates outbound to the attacker's server to receive instructions.
Actions on Objectives: The attacker achieves their goal, such as data exfiltration, encryption for ransomware, or lateral movement to other systems.
Another methodology is the Diamond Model of Intrusion Analysis, which focuses on four core components: the adversary (who is attacking), the infrastructure (tools and servers used), the capability (the malware or technique), and the victim (the target system or person). Analysts use this model to connect seemingly unrelated events into a single campaign.
In practice, you start by collecting data from sources like logs, network flows, and endpoint detection systems. Event correlation is a key technique here — you look for patterns that indicate malicious activity. For example, a single failed login is normal, but 100 failed logins from the same IP address in two minutes is suspicious. You then generate leads, which are pieces of evidence that point to the next step in your investigation. A lead might be a suspicious IP address you saw in a log, which you then query against threat intelligence feeds to see if it's known for hosting malware.
You also validate the alert — sometimes a security tool flags legitimate activity. For example, a penetration testing tool running inside your own network can trigger an intrusion detection system. Part of intrusion analysis is determining whether the alert is a true positive (real attack), false positive (benign activity flagged incorrectly), false negative (an attack that was missed), or true negative (no attack and no alert).
The final step is scoping the incident — figuring out how many systems are affected, what data was accessed, and whether the attacker is still inside. This determines the containment strategy. All of this feeds into an incident report that documents the full timeline, evidence, and recommended actions.
Why does this structured approach matter? Without it, analysts would chase every alert individually, miss patterns, and fail to stop attackers before they reach their objectives. The methodology turns chaos into a repeatable, defensible process that stands up in court and helps organisations improve their defences over time.
Receive and Validate the Alert
The alert fires from your SIEM or intrusion detection system. Do not jump to containment. First, verify the alert is accurate by checking the raw log data. Confirm the source IP, timestamp, and event type. If the activity is legitimate (like a scheduled scan), mark it as a false positive. If it appears malicious, proceed to the next step.
Gather and Preserve Evidence
Collect all relevant logs, network captures, memory dumps, and disk images. Use tools like tcpdump for network traffic or CyLR for endpoint forensic acquisition. Preserve the evidence in a write-protected manner to maintain chain of custody. This step ensures you have the data needed for a thorough analysis and for potential legal proceedings.
Enrich with Threat Intelligence
Query the indicators of compromise (IOCs) you found — IP addresses, file hashes, domain names — against threat intelligence feeds. Use platforms like VirusTotal, AlienVault OTX, or MISP. This tells you if the same attacker has been seen elsewhere, what malware they use, and what their typical tactics, techniques, and procedures (TTPs) are.
Determine the Scope
Figure out how many systems are affected and what the attacker accessed. Check for lateral movement: did the attacker pivot from the initial compromised host to other servers? Review authentication logs, process creation logs, and network connections to map the attacker's footprint. This step defines the boundaries of the incident.
Contain and Document
Once you understand the scope, take action to stop the attack — this might mean isolating the compromised host, blocking the attacker's IP at the firewall, or revoking compromised credentials. Simultaneously, document every finding in your incident management system. The documentation includes timestamps, actions taken, evidence collected, and your analysis conclusions. This record is essential for reporting, forensics, and improving defences.
Imagine you work as a junior security analyst at a mid-sized e-commerce company called ShopFast. Your monitoring dashboard shows an alert: 'Multiple failed SSH login attempts from IP 203.0.113.45 to server web-01.' Your job is to perform intrusion analysis on this alert.
You start by verifying the alert. You check the server logs and find 50 failed login attempts over three minutes, all using the username 'root'. Your first step is to determine if this is a brute-force attack in progress or just a misconfigured monitoring tool. You check the source IP using a threat intelligence platform like VirusTotal or AlienVault OTX. The result shows that IP is associated with a known scanning group. This confirms the alert is a true positive.
Next, you need to identify whether any login succeeded. You search the authentication logs for 'Accepted password' entries. You find one successful login from the same IP five minutes ago. Now you have confirmed a breach. You escalate according to your organisation's incident response plan — you notify the incident response team lead and begin scoping the damage.
You pivot to the affected server. What commands were run? You check the shell history and find the attacker used 'wget' to download a script from a remote server, then executed it with 'bash'. You pull the script from the remote server using a sandbox environment and discover it is a reverse shell payload. The attacker now has a backdoor into the server.
You check for lateral movement. Using your security information and event management (SIEM) tool, you search for connections from web-01 to other internal servers in the last hour. You find outbound connections to the database server db-01 on port 3306 (MySQL). This suggests the attacker is trying to steal customer data. You immediately block both IPs at the firewall and isolate web-01 from the network.
Throughout this process, you are documenting every action in your incident ticketing system. You note timestamps, commands run, files downloaded, and communication with the incident commander. Later, you will create a post-incident report that includes lessons learned: for example, you recommend disabling root SSH login and implementing multi-factor authentication.
This scenario shows the real rhythm of intrusion analysis:
Receiving and validating an alert
Gathering logs and evidence
Using threat intelligence to enrich data
Determining the scope of the breach
Containing the threat
Documenting findings for legal and future prevention
The 200-201 exam tests intrusion analysis primarily through scenario-based multiple choice questions. You will be given a short description of an alert or incident, and you must choose the correct next step in the analysis process, the proper methodology to apply, or the correct interpretation of an evidence type.
Key concepts the exam loves to test:
The seven stages of the Cyber Kill Chain and their order. Expect a question like: 'An attacker sends a spear-phishing email with a malicious attachment. Which stage of the Cyber Kill Chain does this represent?' The answer is 'Delivery'.
The Diamond Model components: adversary, infrastructure, capability, victim. A typical question might give you a scenario and ask which component is missing from the Diamond Model analysis.
The difference between true positive, false positive, true negative, and false negative. You will likely see a question describing an alert and a subsequent investigation — you must classify the alert type.
The concept of leads versus evidence. A lead is a piece of data that requires follow-up; evidence is confirmed data used in a report.
Event correlation: understanding that a single event is not an incident, but many correlated events can be.
Common traps the exam sets:
They will describe a situation where an alert fires, but the logs show the activity was legitimate (e.g., a scheduled vulnerability scan). Many students jump to 'true positive' because an alert fired. The correct answer is 'false positive' because no actual intrusion occurred.
They might ask 'What is the first step in intrusion analysis?' The answers will include 'Contain the threat', 'Identify the attacker', 'Collect evidence', and 'Validate the alert'. The correct first step is validating the alert — you must confirm a real incident before taking action.
They mix up the stages of the Cyber Kill Chain. For example, they might list 'Installation' before 'Exploitation'. The correct order is: Reconnaissance, Weaponisation, Delivery, Exploitation, Installation, Command and Control, Actions on Objectives.
To memorise for the exam:
Cyber Kill Chain stages in order: Reconn, Weaponise, Deliver, Exploit, Install, C2, Act. Use a mnemonic like 'Really Wild Dogs Eat In Cold Air'.
Diamond Model components: Adversary, Infrastructure, Capability, Victim.
Alert classifications: True Positive = bad alert correctly flagged; False Positive = benign activity flagged; False Negative = bad activity missed; True Negative = no activity, no alert.
The goal of intrusion analysis is not just to detect — it is to understand the full scope and impact of the incident.
Expect 3-5 questions from domain 4.1 on the exam. They are often the most applied questions because they test your ability to reason through a scenario rather than just recall a definition.
Intrusion analysis is the process of examining digital evidence to determine if a security breach occurred, how it happened, and what systems are affected.
The Cyber Kill Chain has seven stages in this exact order: Reconnaissance, Weaponisation, Delivery, Exploitation, Installation, Command and Control, Actions on Objectives.
The Diamond Model of Intrusion Analysis uses four components: Adversary, Infrastructure, Capability, and Victim to connect related events into a single attack campaign.
Always validate an alert before escalating — classify it as true positive, false positive, true negative, or false negative before taking action.
Event correlation is the technique of analysing multiple related events (like 100 failed logins from one IP) to identify patterns that indicate malicious activity.
A lead is a piece of evidence that requires further investigation, while confirmed evidence is used in the final incident report.
These come up on the exam all the time. Here's how to tell them apart.
Cyber Kill Chain
Focuses on the sequential stages of an attack from start to goal.
Used to understand the attack lifecycle and anticipate next steps.
Seven linear stages: Reconnaissance through Actions on Objectives.
Diamond Model
Focuses on the four interconnected components of any intrusion event.
Used to link multiple events to the same adversary or campaign.
Four non-linear components: Adversary, Infrastructure, Capability, Victim.
True Positive
Alert correctly identifies actual malicious activity.
Requires immediate investigation and response.
Example: IDS detects a known malware download from the internet.
False Positive
Alert fires for benign activity that is not malicious.
Wastes analyst time but does not indicate a real threat.
Example: IDS flags a legitimate software update as a virus.
Lead
A piece of information that suggests further investigation is needed.
Not yet confirmed as directly related to the intrusion.
Example: A suspicious IP address in a log that requires threat intelligence lookup.
Evidence
A confirmed piece of data that directly supports the incident timeline.
Used in the final report and may be admissible in court.
Example: A log entry showing a successful unauthorised login from that IP.
Mistake
Intrusion analysis is the same as incident response.
Correct
Intrusion analysis is the investigative and analytical part of incident response. Incident response is the broader process that includes detection, containment, eradication, recovery, and post-incident activity.
People lump everything under 'incident response' because the terms are related. The exam distinguishes them clearly: analysis is about understanding the attack; response is about stopping it and recovering.
Mistake
A single alert always means an intrusion has occurred.
Correct
An alert is just a notification. It could be a false positive (legitimate activity flagged incorrectly). You must validate the alert before calling it an intrusion.
In movies, alarms always mean the bad guy is inside. In real IT, alerts are noisy — misconfigurations, routine scans, and user errors all trigger them. Beginners expect every alert to be a real attack.
Mistake
The Cyber Kill Chain starts with the attack itself, like a phishing email.
Correct
The first stage is Reconnaissance, which happens before the attack. The phishing email is the Delivery stage, which is stage three.
People forget that attackers spend time planning. The exam tests the full order, and many students skip Reconnaissance because they think the attack 'begins' with the email.
Mistake
Once you identify the attacker's IP address, the investigation is essentially done.
Correct
Identifying the IP is just one piece of evidence. You still need to determine what systems were affected, what data was accessed, how the attacker got in, and whether they still have access.
Beginners focus on the 'who' and think that solving that mystery solves the case. The exam emphasises that the 'what', 'how', and 'scope' are equally important.
Mistake
False negatives are not a concern because the tool didn't alert.
Correct
False negatives are extremely dangerous because an attack occurred but no one was notified. They represent a failure in detection, which is a core focus of intrusion analysis.
People focus on what the tool catches and ignore what it misses. The exam tests if you understand that missing an attack (false negative) is worse than investigating a false positive.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
Intrusion detection is the automated process of identifying potential threats using tools like IDS/IPS. Intrusion analysis is the manual investigation that follows an alert, where a human examines evidence to confirm the threat, understand its scope, and determine the correct response.
Yes. The exam frequently asks you to identify which stage a given attack activity belongs to. You must know the order: Reconnaissance, Weaponisation, Delivery, Exploitation, Installation, Command and Control, Actions on Objectives.
A SIEM (Security Information and Event Management) tool collects logs from across the network, correlates events, and generates alerts. In intrusion analysis, you use the SIEM to query historical data, identify patterns, and pivot between related events.
An IOC is a piece of forensic evidence that suggests a security breach has occurred. Examples include unusual IP addresses, file hashes known to be malicious, registry key changes, or anomalous network traffic patterns.
You verify the alert by checking the raw logs and comparing the activity to known baselines. If the activity matches a known benign process (like a scheduled antivirus scan), it is a false positive. If it matches known malicious behaviour (like a brute-force login attempt), it is a true positive.
Scoping is the process of determining the full extent of the breach — how many systems are affected, what data was accessed or exfiltrated, and whether the attacker still has access. It guides the containment and eradication efforts.
You've finished Introduction to Intrusion Analysis. Continue through the 200-201 study guide to build a complete picture of the exam.
Done with this chapter?