# Detection, Analysis, and Containment

> Chapter 13 of the Courseiva ISC2-SSCP curriculum — https://courseiva.com/learn/isc2-sscp/detection-analysis-and-containment

**Official objective:** 6.2 — Perform detection, analysis, containment, and eradication of incidents.

## Introduction

SSCP exam objective 6.2 — perform detection, analysis, containment, and eradication of incidents — is the core of what it means to be a security practitioner. Without this skill, you are just a bystander when something goes wrong; with it, you become the person who can spot trouble early, figure out what is happening, stop the damage, and clean up the mess. For the exam, you must understand not just the order of these phases, but the specific purpose and actions within each one.

## The Kitchen Fire Analogy

A kitchen's smoke detector is the first line of defence against a hidden fire. In a busy restaurant kitchen, the chef has multiple gas burners, a deep fryer, and an oven all running at once. The air fills with steam, grease, and the occasional puff of smoke from a seared steak — this is normal background noise. Then one day, the smoke alarm goes off. That shrill beep is the **detection** phase: something unusual is happening. The chef does not instantly douse the whole kitchen in water. Instead, he **analyses** the situation. He looks at which burner is smoking, checks the temperature gauge on the deep fryer, and sniffs the air for a burning plastic smell versus burnt food. He sees a small grease fire has started under the grill. Now he must **contain** it. He does not open the back door to let the fire breathe — that would feed it oxygen. He grabs the metal lid, clamps it over the flaming pan, and turns off the gas supply to that burner. He has isolated the fire to one small area, preventing it from spreading to the curtains or the gas line. Later, he will **eradicate** by cleaning the grease trap, and he will **recover** by ordering a new fire extinguisher and retraining the junior cook. Every phase — detection, analysis, containment, eradication, and recovery — maps precisely to how an IT security team responds to a cyber incident. The kitchen fire is not a generic analogy; it is a specific sequence of actions that mirrors the incident response process for a network breach or malware outbreak.

## Core explanation

In IT security, an 'incident' is any event that threatens the confidentiality, integrity, or availability of your data or systems. Think of it as an uninvited guest who has broken into your house. Detection, analysis, containment, and eradication are the four steps you take to deal with that guest — and the order matters. You cannot contain what you have not detected, and you cannot eradicate what you have not analysed.

**Detection** is the act of noticing that something is wrong. It is the smoke alarm going off. Detection happens through tools and techniques like Intrusion Detection Systems (IDS) — software that watches network traffic for suspicious patterns — or Security Information and Event Management (SIEM) systems that collect logs from firewalls, servers, and applications and raise an alert when something unusual happens. For example, a user logging in from Russia at 3 AM when they live in London might trigger a detection alert. Detection also includes manual reports from users who notice their computer is behaving strangely, like files disappearing or the cursor moving on its own.

**Analysis** is the investigation phase. You take the alert — the 'something unusual' — and you figure out what is really happening. Is it a false positive (a false alarm, like the smoke detector going off because of burnt toast) or a true positive (a real fire)? Analysis involves looking at logs, checking what the user was doing at the time, examining network traffic, and sometimes talking to the user. In an SSCP context, you might use a tool like Wireshark to look at network packets (tiny chunks of data travelling across the network) or check the Windows Event Viewer for error codes. The goal of analysis is to determine the scope: is it one device, one user, or the entire company? What type of malware is it? What data might have been stolen? This phase is where you move from 'something is wrong' to 'here is exactly what happened'.

**Containment** is the emergency shut-off valve. Once you know what the incident is, you must stop it from spreading. If a virus is spreading from computer to computer, you would disconnect the infected computer from the network (a process called 'isolation'). If an attacker is using a stolen password, you would reset that password and force a logout of all active sessions. Containment is temporary — it is about stopping the bleeding, not fixing the wound. There are short-term containment actions (like blocking an IP address at the firewall) and long-term containment actions (like applying a security patch to the vulnerable software). The most common containment mistake beginners make is trying to 'clean up' before containing. You cannot clean a spill while the tap is still running.

**Eradication** is the clean-up. Once the threat is contained, you remove it entirely. This means deleting malware, closing the vulnerability the attacker used, resetting all compromised passwords, and rebuilding compromised systems from a known-good backup. In a serious incident, eradication might involve wiping a server completely and reinstalling the operating system. Eradication is not done until you are certain the attacker has no way back in — that means changing all credentials, not just the ones the attacker used, and applying all necessary security updates.

After eradication comes **Recovery**, which is sometimes included in the same phase but is a separate concept. Recovery is about bringing the affected systems back into normal operation, testing them to ensure they are clean, and monitoring them closely for any signs that the attacker has returned. The SSCP exam may ask you to distinguish between containment (stopping the spread) and eradication (removing the threat source) — they are not the same.

The entire process is part of a discipline called Incident Response (IR). Most organisations have an Incident Response Plan (IRP) document that outlines exactly who does what during each phase. The SSCP exam expects you to know the order and the key actions in each phase, especially the difference between containment and eradication.

## Real-world context

Let us walk through how a real IT security professional named Priya handles an incident at a mid-sized company called GreenLeaf Tech, which sells garden supplies online.

**Detection**: Priya gets an alert from the company's SIEM tool (Splunk) at 2:47 AM. The alert says 'Unusual outbound data transfer from Database Server DB-03 — 500MB transferred to an unknown IP address in Belarus.' This is a red flag because DB-03 contains customer payment details. Priya sees the alert on her phone and logs into the system remotely.

**Analysis**: She first checks the SIEM logs to see what user account initiated the data transfer. It shows the database service account — the one that runs automated backups — sent the data. That is odd because the backup job runs at 1 AM and finished already. She then looks at the network traffic logs and sees the data left on an encrypted channel (HTTPS), which is unusual for a legitimate backup. She examines the database server's event logs and finds a PowerShell script that was executed at 2:40 AM — a script she did not recognise. She runs a hash of that script through a threat intelligence platform like VirusTotal and finds it matches a known data-stealing trojan called 'ExfilStealer'.

**Containment**: Without waiting for approval from management (because time is critical), Priya immediately takes the following actions:
- She disconnects DB-03 from the network by clicking 'Disable Network Adapter' in the server's management console. The server is now isolated.
- She revokes the database service account's permissions and changes its password.
- She blocks the IP address in Belarus at the company firewall.
- She sends an email to the CEO and CISO (Chief Information Security Officer) explaining the situation and the containment steps taken.

**Eradication**: The next morning, Priya works with the server team to rebuild DB-03 from a clean backup from two days earlier — before the attack. She applies all security patches that were missing. She also runs a full malware scan on all other servers that communicate with DB-03 to ensure the trojan has not spread. She resets the passwords for every account that had access to DB-03.

**Recovery**: Once the server is rebuilt and patched, she brings it back online but monitors its outbound traffic closely for 48 hours. She also implements a new rule in the firewall to alert on any outbound data transfer over 100MB.

**Tools used in this scenario**:
- Splunk (SIEM for log aggregation and alerting)
- Firewall logs (to see blocked/allowed traffic)
- Windows Event Viewer (for PowerShell execution logs)
- VirusTotal (to check file hashes against known malware)
- Network isolation tools (like disabling a network adapter)

Priya's actions show that real-world incident handling is fast, decisive, and follows a clear sequence. She did not try to analyse for days before acting — she contained first, then analysed more deeply. That is the practical mindset the SSCP exam rewards.

## Exam focus

The SSCP exam tests objective 6.2 in several specific ways. First, expect scenario-based questions where you are given a description of an incident and asked which phase of response is occurring. For example: 'A security analyst notices unusual traffic and begins reviewing logs to determine the source. Which phase is this?' The answer is 'Analysis' — not detection, because the alert already happened.

**Key question patterns:**
- Ordering questions: 'What is the correct sequence of incident response phases?' Answer is Detection, Analysis, Containment, Eradication, Recovery. The exam loves to swap two phases, like putting Containment before Analysis. Remember: you must understand the threat before you can safely contain it, so analysis always comes before containment in a proper response.
- Containment vs Eradication questions: They will give you an action like 'removing malware from a server' and ask what phase that belongs to. Removing malware is Eradication, not Containment. Containment is about isolating the system — for example, unplugging the network cable.
- Decision-making questions: 'An incident is detected on a critical production server that cannot be taken offline. What should you do first?' The trap is to say 'analyse the server' — but in a production environment where you cannot disconnect, you might first increase monitoring or apply a temporary ACL (Access Control List) to block the attacker while you analyse.

**Traps the exam sets:**
- 'Detection' vs 'Monitoring': Detection is a specific event that triggers a response. Monitoring is the ongoing activity. The exam might say 'continuous observation of logs' and ask if that is detection — it is not; it is monitoring. Detection is the moment an alert fires.
- 'Containment' vs 'Eradication' with synonyms: If the question says 'stop the spread', that is containment. If it says 'remove the threat source', that is eradication. Learn the verb pairs.
- 'False positive' and 'False negative': A false positive is an alert that fires when there is no incident (the detective cries wolf). A false negative is an incident that happens but no alert fires (the wolf eats the sheep without anyone noticing). The exam tests which one is more dangerous — false negatives are worse because the attack continues unseen.

**Definitions you must memorise:**
- Incident: an event that violates security policy or threatens confidentiality, integrity, or availability (CIA triad).
- Detection: identification of a potential incident through automated or manual means.
- Analysis: investigation to confirm the incident, determine scope, and identify root cause.
- Containment: limiting the damage and preventing further spread.
- Eradication: removing the root cause of the incident.
- Recovery: restoring normal operations and monitoring for recurrence.

**Common exam question topics:**
- The difference between a 'security event' (something that happens) and a 'security incident' (a confirmed violation)
- The role of the Incident Response Team (IRT) and the chain of communication during containment
- Why you should preserve evidence (logs, memory dumps) during analysis before taking containment actions — because containment actions can destroy evidence
- The importance of 'chain of custody' if the incident may lead to legal action

## Step by step

1. **1. Detection — The Alert** — An automated tool (like a SIEM, IDS, or antivirus) or a human user reports something unusual. For example, a firewall logs a connection attempt to a known malicious IP address. The key point: detection does not confirm an incident yet — it is just a signal that something needs investigation.
2. **2. Analysis — The Investigation** — The security analyst examines the alert and related data (logs, network traffic, system files) to determine if the alert is a true positive or a false positive. They also assess the scope — which systems are affected, what data may be at risk, and what type of attack it is. Without analysis, you do not know what you are containing.
3. **3. Containment — The Stop Gap** — Based on the analysis, the analyst takes immediate action to prevent the incident from spreading or causing more damage. This could involve isolating a workstation from the network, blocking an IP address at the firewall, disabling a compromised user account, or powering down a server. Containment is temporary and focused on limiting harm.
4. **4. Eradication — The Clean-up** — Once the incident is contained, the team removes the threat. This includes deleting malware, closing the vulnerability (e.g., applying a patch), resetting all compromised passwords, and rebuilding compromised systems from clean backups. Eradication ensures the attacker cannot easily return.
5. **5. Recovery — The Return to Normal** — The affected systems are restored to full operation, tested for integrity, and monitored closely for any signs of reinfection or continued attacker activity. The incident is formally closed only after a post-incident review identifies lessons learned and improvements to prevent recurrence.

## Comparisons

### Detection vs Analysis

**Detection:**
- The moment an alert or observation signals a potential issue
- Focuses on 'something is wrong' but not 'what'
- Typically automated via IDS, SIEM, or antivirus

**Analysis:**
- The investigation to confirm and understand the alert
- Focuses on 'what happened, how, and to what extent'
- Typically manual, using logs and forensic tools

### Containment vs Eradication

**Containment:**
- Seeks to stop the incident from spreading or causing more harm
- Temporary and focused on limiting damage
- Actions include isolation, blocking IPs, disabling accounts

**Eradication:**
- Seeks to completely remove the threat source
- Permanent and focused on cleaning the system
- Actions include deleting malware, patching, rebuilding systems

### False Positive vs False Negative

**False Positive:**
- An alert fires when no real incident exists
- Wastes time and resources investigating a non-threat
- Less dangerous because no actual damage occurs

**False Negative:**
- A real incident occurs but no alert fires
- The attack continues undetected, causing potential damage
- More dangerous because it goes unnoticed

### Event vs Incident

**Event:**
- Any observable occurrence in a system or network
- May be normal or benign (e.g., successful login)
- Does not automatically require a response

**Incident:**
- A specific event that violates security policy or threatens the CIA triad
- Always requires investigation and a response
- Triggers the incident response process

## Diagram

_The incident response process: from detection through analysis, containment, eradication, recovery, and post-incident review._

```mermaid
flowchart TD
    A[Detection: Alert fires] --> B[Analysis: Investigate alert]
    B --> C{Is the incident real?}
    C -- No --> D[False Positive: Document and close]
    C -- Yes --> E[Containment: Stop the spread]
    E --> F[Eradication: Remove threat source]
    F --> G[Recovery: Restore and monitor]
    G --> H[Post-Incident Review: Learn lessons]
```

## Common misconceptions

- **Misconception:** Containment always means disconnecting the system from the network. **Reality:** Containment is about stopping the spread, but it does not always mean disconnecting. In some cases (like a critical server that cannot go offline), containment might mean applying a firewall ACL to block only the attacker's IP, or putting the system in 'quarantine mode' with restricted user access. (New learners see the dramatic step of 'unplugging the cable' in movies and assume that is the only option. Real IT environments have complex uptime requirements that prevent simple disconnection.)
- **Misconception:** Detection and analysis are the same thing — you detect something and you analyse it as part of the same step. **Reality:** Detection is the alert that something may be wrong (the bell rings). Analysis is the separate investigation to determine if the alert is real and what it means. You can detect a potential incident and then, after analysis, decide it was a false positive — meaning no real incident occurred. (The terminology is similar enough that beginners combine them mentally. The SSCP exam explicitly tests the distinction, so it is important to keep them separate.)
- **Misconception:** Eradication is the final step — once you remove the malware, the incident is over. **Reality:** Eradication is followed by Recovery, which includes restoring services, testing systems, and monitoring for signs that the attacker has returned. The incident is not closed until recovery is complete and a post-incident review has been conducted. (People naturally think 'clean up = done', but security incidents often leave backdoors. Recovery ensures the attacker cannot simply break back in through the same hole.)
- **Misconception:** You should always contain first and analyse later to stop damage quickly. **Reality:** You must do initial analysis before containment to understand what you are containing. If you blindly disconnect a server, you might stop a legitimate business process or destroy evidence needed to understand the attack. The correct order is: detect, perform rapid analysis to confirm threat scope, then contain, then deeper analysis for eradication planning. (The instinct to 'stop the bad thing immediately' is powerful. But in IT, hasty containment can cause more business damage than the incident itself — like disconnecting a payment server during Black Friday sales.)
- **Misconception:** If the malware is removed, you do not need to change passwords or apply patches. **Reality:** Eradication includes removing the attacker's access paths. If you only delete the malware but do not patch the vulnerability it used, or change the compromised password, the attacker can simply reinfect the system. Complete eradication requires closing all vectors the attacker used. (This comes from a 'clean the house but leave the front door open' mindset. Beginners focus on the visible problem (malware) but forget the underlying vulnerability.)

## Key takeaways

- The five phases of incident response in order are: Detection, Analysis, Containment, Eradication, and Recovery.
- Detection is the moment an alert or observation indicates a potential security incident, while analysis is the investigation to confirm and understand that incident.
- Containment aims to stop the spread of damage, not to remove the threat — that is the role of eradication.
- Eradication removes the root cause of the incident, such as malware or a vulnerability, but recovery restores normal operations and verifies the system is safe.
- A false positive is an alert that fires when no real incident exists; a false negative is a real incident that goes undetected, and false negatives are more dangerous.
- You should perform enough analysis to confirm the incident and understand its scope before taking containment actions, to avoid destroying evidence or disrupting critical services unnecessarily.
- Always preserve evidence (logs, memory dumps, disk images) during analysis so that legal action or deeper forensic investigation is possible later.
- Chain of custody must be documented whenever evidence is collected, especially if the incident may lead to criminal prosecution.

## FAQ

**What is the difference between an event and an incident in cybersecurity?**

An event is any observable occurrence in a system, like a user logging in or a firewall blocking a connection. An incident is a specific type of event that violates security policy or poses a threat to the CIA triad (confidentiality, integrity, or availability). Every incident starts as an event, but not every event becomes an incident.

**Do I always need to disconnect a computer from the network during containment?**

No. Disconnection is one containment option, but it is not always appropriate. For critical servers that cannot go offline, containment might involve blocking specific IP addresses at the firewall, disabling a particular user account, or using a network ACL to restrict traffic. The goal is to stop the incident's spread, and the method depends on the situation.

**What is the most important phase of incident response?**

No single phase is most important — they all depend on each other. However, analysis is often the phase where mistakes happen because people skip it or perform it too quickly. Without proper analysis, you may contain the wrong system, miss the true source, or destroy evidence. Good analysis sets the stage for effective containment and eradication.

**What is a false positive in incident detection?**

A false positive occurs when a detection tool raises an alert for something that looks like an attack but is actually normal behaviour. For example, a firewall might flag a legitimate software update as a threat. False positives waste time but are less dangerous than false negatives, which are actual attacks that go undetected.

**How do I know when an incident is fully over?**

An incident is fully over after recovery is complete and a post-incident review has been conducted. Recovery includes verifying that systems are clean, monitoring for signs of reinfection, and restoring normal operations. The review documents what happened, what was done, and what improvements are needed. Only then is the incident formally closed.

**What tools do security professionals use for detection and analysis?**

Common tools include SIEM systems (like Splunk or QRadar) that centralise logs, IDS/IPS (Intrusion Detection/Prevention Systems) that monitor network traffic, antivirus software, endpoint detection and response (EDR) tools like CrowdStrike, and packet analysers like Wireshark. For analysis, they also use forensic tools to examine disk images and memory dumps.

## Check your understanding

1. **What is the correct order of the five phases of incident response?**

   Answer: Detection, Analysis, Containment, Eradication, Recovery.

2. **In which phase would you disconnect a compromised computer from the network?**

   Answer: Containment. This action stops the threat from spreading to other systems.

3. **What is the difference between a false positive and a false negative?**

   Answer: A false positive is an alert that fires when no real incident exists; a false negative is a real incident that goes undetected.

4. **Why must you perform analysis before containment?**

   Answer: To understand the scope and nature of the threat so that you can contain the correct systems without destroying evidence or disrupting critical services unnecessarily.

5. **What is the final phase of incident response that includes restoring systems and monitoring for recurrence?**

   Answer: Recovery.

---

Interactive version with quiz and diagrams: https://courseiva.com/learn/isc2-sscp/detection-analysis-and-containment