# Security Operations and Incident Response

> Chapter 12 of the Courseiva CASP-PLUS curriculum — https://courseiva.com/learn/casp-plus/security-operations-and-incident-response

**Official objective:** 4.1 — Manage security operations including SOC processes, incident response lifecycle, and forensic investigations.

## Introduction

How do you stop a burglar who is already inside your house? You can't just ignore them and hope they leave. That is the problem Security Operations and Incident Response solves: how to detect, contain, and recover from a live security breach while gathering evidence to prevent it happening again. For the CAS-005 exam, this topic is one of the most heavily tested areas because it covers what security professionals actually do in a real crisis.

## The Hospital Emergency Room Analogy

Because a hospital can't stop patients from getting sick, it builds an Emergency Room (ER) to handle the chaos. This is the same reason organisations build a Security Operations Centre (SOC) — you can't prevent every cyber problem, but you can build a team and a process to handle them when they happen.

In a hospital ER, the triage nurse is the first person you see. They don't treat you; they quickly sort you into 'critical', 'urgent', or 'stable'. This maps to a SOC analyst doing 'triage' on security alerts — deciding which ones need immediate action and which can wait. The ER doctor then runs tests (like a CT scan) to work out exactly what is wrong. In IT, this is the 'forensic investigation' phase where analysts collect logs and evidence to understand the attack. The surgeon operates to stop the bleeding, which is the 'containment' phase of incident response — cutting off the attacker's access to the network. Finally, the patient goes to a recovery ward and the hospital reviews what went wrong to improve for next time. This is the 'lessons learned' phase, where the team updates their playbook to prevent a repeat incident. Every step in the ER has a clear process, just like the incident response lifecycle has six defined phases. Without the ER, chaos. Without the SOC, the same.

## Core explanation

Security Operations and Incident Response is the discipline of monitoring an organisation's IT systems for security threats and then reacting to them in a structured way. It sits inside the broader field of 'Security Operations', which includes everything from staffing a 24/7 monitoring team to choosing the right software tools.

The central hub for this work is the Security Operations Centre (SOC). A SOC is a dedicated team — often in a room full of screens — that watches the organisation's network, servers, and endpoints (laptops, phones) for suspicious activity. Think of it as the security guard booth for the whole company, but instead of watching a single door, they watch thousands of digital doors at once.

When the SOC spots something suspicious, they use the Incident Response Lifecycle (often called the IR Lifecycle). This is a standard six-phase process defined by the National Institute of Standards and Technology (NIST). The phases are:

- Preparation: The team gets ready before any incident happens. They write playbooks (step-by-step response guides), install detection tools, and train staff.
- Detection and Analysis: The team identifies that something is wrong. They confirm it is a genuine threat (not a false alarm) and work out what kind of attack it is — for example, ransomware or a data breach.
- Containment, Eradication, and Recovery: The team stops the attack from spreading (containment), removes the attacker's tools from the network (eradication), and brings systems back to normal operation (recovery).
- Post-Incident Activity: The team writes a report on what happened, what they did well, and what they will improve. They also hand over evidence for potential legal action.

Each phase has its own sub-tasks. For example, 'Containment' might mean disconnecting an infected laptop from the network, while 'Eradication' might mean wiping that laptop's hard drive and reinstalling the operating system.

Forensic Investigations are a subset of incident response. Forensics is the careful collection and analysis of digital evidence. The key rule is to preserve the 'chain of custody' — a documented trail of who handled the evidence and when, so it can hold up in court. Forensics analysts use tools to create a 'forensic image' (an exact bit-by-bit copy) of a hard drive, because working directly on the original drive would alter it and destroy evidence.

Why does this matter for an organisation? Without a SOC and an IR lifecycle, a small ransomware infection can spread across an entire network in minutes, costing millions in ransom payments, lost business, and legal fines. By having a structured process, the organisation reduces the 'dwell time' — how long the attacker sits undetected — from months to hours or even minutes.

CAS-005 expects you to know the exact order of the IR lifecycle phases, the difference between a SOC analyst (level 1), a lead investigator (level 2), and a manager (level 3), and the legal requirements for forensic evidence. You also need to understand that detection tools like SIEM (Security Information and Event Management) correlate logs from many sources to spot patterns, such as a user logging in from New York and Tokyo within 10 minutes.

## Real-world context

Imagine you are a SOC analyst for a mid-sized e-commerce company called 'ShopFast'. You have 500 employees and thousands of customers. It is a Tuesday afternoon and you are monitoring a dashboard called a SIEM. The SIEM shows a spike in failed login attempts from an IP address in Russia against an employee account named 'jsmith'. Your job is to decide if this is a real attack or just a customer typing the wrong password.

Step one: you open the SIEM alert and look at the details. You see that the login attempts are for 'jsmith@shopfast.com', which is the CEO's assistant. That account has access to financial spreadsheets and customer data. This is a red flag. You 'triage' the alert as 'high severity' and escalate it to a Level 2 analyst within the SOC.

The Level 2 analyst, Maria, takes over. She runs a 'packet capture' tool called Wireshark to see the network traffic from that IP address. She also checks the 'authentication logs' from Microsoft Entra ID (formerly Azure Active Directory) to see if any login succeeded. She finds that one login did succeed two minutes ago, and then the attacker immediately changed the password. This confirms an incident.

Maria follows the IR playbook. First, she 'contains' the incident by disabling JSmith's account and blocking the Russian IP address at the firewall. Then she 'eradicates' by scanning JSmith's computer for malware and forcing a password reset for all accounts that had access to the same financial data. She then 'recovers' the environment by restoring a clean backup of a shared drive that was accessed by the attacker.

Next, the team does a 'forensic investigation'. A forensic analyst creates a 'bit-for-bit' image of JSmith's laptop hard drive and stores it in a secure evidence locker (a locked hard drive cabinet). They document every step in a 'chain of custody' form, noting who removed the drive, when, and where it is stored. They find that the attacker installed a 'keylogger' that captured JSmith's password.

Finally, the team writes a 'post-incident report'. They recommend adding multi-factor authentication (MFA) for all executive assistants and scheduling monthly security awareness training. The report is sent to the Chief Information Security Officer (CISO) who approves the changes. The SOC team also updates their playbook to include a new step: checking Microsoft Entra ID logs within the first minute of a high-severity alert.

What you, as the IT professional, actually do in this job is:
- Monitor SIEM dashboards for alerts
- Triage alerts by severity (low, medium, high, critical)
- Escalate confirmed incidents to Level 2 analysts
- Run basic containment actions (disable accounts, block IPs at the firewall)
- Participate in post-incident reviews
- Maintain the chain of custody for any evidence you collect

All of these tasks require following a strict process. There is no room for guessing, because a mistake can destroy evidence or let an attacker slip through.

## Exam focus

CAS-005 tests Security Operations and Incident Response heavily. Expect at least 15-20% of your exam questions to come from this domain. The exam writers love to check if you know the exact definitions and order of things. Here is what you need to memorise perfectly:

First, the six phases of the NIST Incident Response Lifecycle. The official order is: Preparation, Detection and Analysis, Containment/Eradication/Recovery, and Post-Incident Activity. Some study guides combine Containment, Eradication, and Recovery into one phase, so you get four phases. CAS-005 uses the four-phase model (NIST SP 800-61 Rev 2). Know the phases by heart and know what activities happen in each.

Second, the difference between a SIEM and a SOAR. A SIEM (Security Information and Event Management) collects logs and alerts. A SOAR (Security Orchestration, Automation, and Response) automates the response to those alerts — for example, it can automatically disable a compromised account. The trap question will give you a scenario where an alert fires and ask whether you use a SIEM or SOAR. Answer: if the question says 'automatically blocks the IP', it is SOAR.

Third, forensic evidence rules. CAS-005 loves testing the 'chain of custody'. A typical question: 'An analyst collects a hard drive from a compromised server. What document must they complete to ensure the evidence is admissible in court?' Answer: the chain of custody form. Also know that a forensic image must be a bit-for-bit copy (not a file copy) and that you should never work on the original drive.

Fourth, types of SOC analysts. Know the three-tier model:
- Tier 1: Monitors alerts, triages, escalates
- Tier 2: Investigates confirmed incidents, performs deeper analysis
- Tier 3: Threat hunting, advanced forensics, incident management

Fifth, key legal concepts like 'order of volatility' when collecting evidence. You must collect the most volatile data first (RAM, running processes) before powering down a machine to collect the hard drive. If you turn off a computer, you lose the data in memory.

Common traps they set:
- They give you a scenario where the incident is over and ask what to do next. The correct answer is always 'post-incident activity' or 'lessons learned'.
- They ask about 'containment' versus 'eradication'. Containment stops the bleeding (e.g., disconnect the cable). Eradication removes the cause (e.g., delete the malware). They will mix these up.
- They ask about 'false positive' versus 'true positive' versus 'false negative'. A false positive is an alert that fires when there is no attack (like a fire alarm going off because of burnt toast). A false negative is when an attack happens but no alert fires (the worst case).

Key definitions to memorise:
- Dwell time: the time an attacker is present in a network before being detected
- Mean Time to Detect (MTTD): average time from start of incident to detection
- Mean Time to Respond (MTTR): average time from detection to containment
- Playbook: a step-by-step guide for responding to a specific type of incident
- Runbook: a broader set of procedures for operating a system (less specific than a playbook)

The exam expects you to pick the right tool for the right job. For example, if the question says 'an organisation needs to correlate logs from multiple sources to detect anomalies', the answer is SIEM. If the question says 'an organisation needs to automatically respond to phishing emails', the answer is SOAR.

## Step by step

1. **Detection and Alert Triage** — The SOC receives an alert from the SIEM. The Level 1 analyst verifies the alert is not a false positive by checking raw logs. If confirmed as a real threat, the analyst assigns a severity level (low, medium, high, critical) and escalates to Level 2. This step is critical because it filters out noise so the senior team only spends time on genuine incidents.
2. **Incident Confirmation and Analysis** — The Level 2 analyst investigates the details: what systems are affected, what accounts are compromised, and what type of attack it is (e.g., phishing, ransomware, data exfiltration). They use tools like packet captures (Wireshark) and log analysis (Microsoft Entra ID logs) to confirm the attack vector. This step determines the correct containment strategy.
3. **Containment** — The analyst takes immediate action to stop the incident from spreading. Common containment actions include disabling compromised user accounts, blocking malicious IP addresses at the firewall, isolating infected machines from the network, and disconnecting external connections. This is the 'stop the bleeding' phase and must be done quickly but carefully to avoid destroying evidence.
4. **Eradication and Recovery** — After containment, the team removes all traces of the attacker from the environment. This includes deleting malware, restoring clean backups, patching vulnerabilities, and changing passwords. Then recovery begins — bringing systems back into production in a safe state. Both steps are documented for the post-incident report.
5. **Post-Incident Activity and Lessons Learned** — The team writes a detailed report summarising the incident timeline, what worked, what failed, and recommended improvements. The chain of custody is finalised and stored. The playbook is updated based on lessons learned. This phase prevents the same incident from recurring and is essential for regulatory compliance and insurance claims.

## Comparisons

### SIEM (Security Information and Event Management) vs SOAR (Security Orchestration, Automation, and Response)

**SIEM (Security Information and Event Management):**
- Focuses on detecting threats by correlating logs from multiple sources
- Does not take automatic action; generates alerts for human review
- Primary function is visibility and detection

**SOAR (Security Orchestration, Automation, and Response):**
- Focuses on automating the response to threats (e.g., automatically blocking an IP)
- Takes automatic action based on playbooks without waiting for a human
- Primary function is response and remediation

### False Positive vs False Negative

**False Positive:**
- Alert fires but there is no actual attack (burnt toast causing fire alarm)
- Wastes analyst time chasing non-threats
- Better than a false negative because it does not let an attacker go unnoticed

**False Negative:**
- No alert fires but there is a real attack
- The attacker remains undetected, causing damage
- Far more dangerous; the organisation does not know they are breached

### Containment vs Eradication

**Containment:**
- Stops the incident from spreading (e.g., disconnecting a laptop from the network)
- Is done first, immediately after detection
- Does not remove the underlying cause; it just isolates it

**Eradication:**
- Removes the attacker's tools and malware from the environment
- Is done after containment is complete
- Includes scanning, cleaning, and applying patches to remove the root cause

### Tier 1 SOC Analyst vs Tier 2 SOC Analyst

**Tier 1 SOC Analyst:**
- Monitors alerts and performs initial triage
- Has limited decision-making authority; escalates most issues
- Focuses on speed and filtering false positives

**Tier 2 SOC Analyst:**
- Investigates confirmed incidents in depth
- Has authority to make containment decisions
- Focuses on understanding the attack and containing it properly

### Playbook vs Runbook

**Playbook:**
- Specific to one type of incident (e.g., ransomware playbook)
- Contains step-by-step instructions for response actions
- Used during an active incident to guide decision-making

**Runbook:**
- Covers broader operational procedures for maintaining a system (e.g., patching a server)
- Not incident-specific; used for routine maintenance
- Used for regular operations, not crisis response

## Diagram

_Flowchart showing the incident response process from initial alert to post-incident review within a SOC._

```mermaid
flowchart TD
    A[Security Operations Centre (SOC)] --> B[SIEM collects logs]
    B --> C[Alert generated]
    C --> D[Triage by Tier 1 analyst]
    D --> E{Is it a real incident?}
    E -->|Yes| F[Escalate to Tier 2]
    E -->|No| G[Close as false positive]
    F --> H[Containment: disable account, block IP]
    H --> I[Eradication: remove malware]
    I --> J[Recovery: restore from backup]
    J --> K[Post-Incident Report and Lessons Learned]
```

## Common misconceptions

- **Misconception:** Incident response is only about stopping the attack; forensics is a separate, optional step. **Reality:** Forensics is an integrated part of incident response. Every step in the IR lifecycle must be documented for potential legal action. You cannot separate the two. (TV shows often portray forensics as a process that happens days after the 'action' is over. In reality, forensics begins at the moment of detection, because the decisions you make during containment can destroy evidence if not done carefully.)
- **Misconception:** A SOC is a physical room full of people staring at screens, and that is the only model. **Reality:** A SOC can be fully virtual, outsourced to a Managed Security Service Provider (MSSP), or a hybrid model. Many organisations do not have the budget for an in-house room. (The visual of a 'war room' from movies is powerful. Beginners assume every company has that. In small businesses, the SOC might be one person in a home office checking alerts on a laptop.)
- **Misconception:** The chain of custody only matters if the case goes to court, so for small incidents you can skip it. **Reality:** Chain of custody must be maintained from the first moment you touch any piece of evidence, even for internal investigations. If you skip it and the incident later escalates to a lawsuit or regulatory fine, the evidence is worthless. (Beginners think of 'evidence' as something for criminal trials only. They forget about civil lawsuits from customers or regulatory fines from GDPR or HIPAA, which also require admissible evidence.)
- **Misconception:** A SIEM automatically stops attacks. **Reality:** A SIEM only detects and alerts. It generates warnings, but a human (or a SOAR platform) must take action. SIEM is purely a detection tool. (The name 'Security Information and Event Management' sounds active. Beginners assume 'Security' in the name means it provides security. It is only a visibility tool, like a security camera that records but does not call the police.)
- **Misconception:** The most important skill in incident response is technical hacking ability. **Reality:** The most important skill is following a process and documenting everything. Technical hacking skills help, but if you cannot follow the incident response playbook and maintain chain of custody, you will fail in a real incident. (Pop culture glorifies the 'hacker' who breaks into systems. In incident response, you are the defender, and the process (not the hacking) is what stops the attack and preserves evidence.)

## Key takeaways

- The NIST Incident Response Lifecycle has four phases: Preparation, Detection and Analysis, Containment/Eradication/Recovery, and Post-Incident Activity.
- A SIEM (Security Information and Event Management) detects threats by correlating logs; a SOAR (Security Orchestration, Automation, and Response) automatically responds to those threats.
- The chain of custody is a documented log of who, when, and where evidence was handled; without it, digital evidence is inadmissible in court.
- Dwell time is the duration an attacker remains undetected in a network; reducing dwell time from months to hours is the primary goal of a SOC.
- Order of volatility requires collecting the most fragile data first (RAM, active network connections) before powering off a system to collect the hard drive.
- A false negative (attack occurs but no alert fires) is far more dangerous than a false positive (alert fires but no attack), because a false negative means the attacker goes unnoticed.

## FAQ

**What is the difference between a SOC and a SIEM?**

A SOC is a team or department of people who monitor threats. A SIEM is a software tool that collects logs and generates alerts. The SOC uses the SIEM as their primary tool, but they are not the same thing.

**Do I need to know the NIST incident response phases by heart for CAS-005?**

Yes, absolutely. The exam will ask you to identify which phase a specific action belongs to, and it will give you distractor answers that are out of order. Memorise the four phases: Preparation, Detection and Analysis, Containment/Eradication/Recovery, and Post-Incident Activity.

**What is a 'playbook' in incident response?**

A playbook is a step-by-step written guide for handling a specific type of incident, such as a ransomware playbook that tells you exactly which commands to run and who to call. It is different from a runbook, which covers broader operational procedures.

**Can an organisation outsource its SOC?**

Yes, many organisations use a Managed Security Service Provider (MSSP) to run their SOC 24/7 at a lower cost. The MSSP monitors the client's logs remotely and alerts them when an incident is detected. This is called a virtual or outsourced SOC.

**What is the 'order of volatility' in forensics?**

It is the rule that you must collect the most volatile data first — data that will disappear if you turn off the machine. The order is: RAM, running processes, network connections, temporary files, then the hard drive. If you power off the computer, you lose everything in RAM.

**What is a 'false negative' in the context of SOC alerts?**

A false negative is when a real attack occurs but the SIEM does not generate any alert. This is the most dangerous type of error because the attacker continues undetected. It happens when the SIEM's detection rules are poorly configured or missing.

## Check your understanding

1. **What is the primary purpose of the 'containment' phase in the incident response lifecycle?**

   Answer: To stop the incident from spreading to other systems or users, for example by disconnecting an infected machine from the network.

2. **What document must be maintained to ensure digital evidence is admissible in court?**

   Answer: The chain of custody form, which records who handled the evidence, when, and where it was stored.

3. **What type of data should be collected first in a forensic investigation according to the order of volatility?**

   Answer: The most volatile data, which is the contents of RAM (memory), because it is lost when the system is powered off.

4. **What is the key difference between a SIEM and a SOAR platform?**

   Answer: A SIEM detects and alerts on threats; a SOAR automatically takes action to respond to those threats, such as blocking an IP address.

5. **In the NIST IR lifecycle, which phase comes immediately after 'containment, eradication, and recovery'?**

   Answer: Post-Incident Activity, which includes writing a report, documenting lessons learned, and updating playbooks.

---

Interactive version with quiz and diagrams: https://courseiva.com/learn/casp-plus/security-operations-and-incident-response