What is incident response

When building a new SOC or augmenting an existing SOC, you should consider incorporating key technologies to improve your enrichment, detection, and response capabilities, such as follows:

• Cloud native SIEM – With a cloud-native SIEM, there are no upfront costs, you pay only for what you use. Cloud-native SIEMs helps you collect data at a cloud scale across all users, devices, applications, and infrastructure, both on-premises and in multiple clouds, and incorporates threat intelligence and other sources of enrichment.
• Automation and orchestration – Automation and orchestration capabilities include the collection of software solutions and tools that allow organizations to streamline security operations in three key areas: threat and vulnerability management, incident response, and security operations automation.
• Threat Intelligence – Threat intelligence is evidence-based knowledge about an existing or emerging threat to assets that can be used to inform decisions regarding the subject’s response to that threat. There are three levels of Threat Intelligence: Strategic, Operational, and Tactical. Strategic looks at the changes in the broader threat landscape and is primarily aimed at executives. Operational seeks to understand how an organization could be attacked by outlining Tactics, Techniques and Procedures (TTPs). Tactical covers the details of an attack with the shortest lifespan, such as Indicators of Compromise (IOCs) that are usually fed into the SIEM or firewalls.
• Threat Hunting – Threat hunters typically work assuming the network has already been breached. Threat hunting involves proactively searching for evidence of malware or attackers hiding within a network. However, threat hunting is not only about threat detection, threat hunters also help reduce the attack surface of an organization – improving the network’s security posture over time.
• Vulnerability Management – Vulnerability Management includes four stages: Vulnerability Scanning, Vulnerability Intelligence, Vulnerability Simulations (aligned to the MITRE ATT&CK matrix and Cyber Kill Chain methodologies), and Vulnerability Remediation.
• Endpoint Detection and Response – EDR combines real-time continuous monitoring and collection of endpoint data with rule-based, automated analysis and response capabilities. Integrating it with your SOC gives Security teams a centralized platform for continuously monitoring endpoints and responding to incidents as they arise – often via automated response.

To maximize efficiencies and react quickly to threats, modern SOCs should implement automated enrichment and response activities using playbooks and computer security incident management workflows.

Level 1 analysts generally function as the alert triage team that is responsible for examining alerts, escalating those that may represent an attack. The work done by L1 analysts today mostly involves understanding context, making judgement calls about alerts, and escalating where necessary to L2 analysts.

An effective component of incident response plan management is for SOC teams to continuously produce new and relevant use cases (aka attack scenarios). These use cases should include all aspects of the use case lifecycle.

Use cases should represent the outcome of an attack, or the outcome that an attacker seeks to achieve. This outcome should map to the MITRE ATT&CK Matrix Impact category. The use case “factory” should utilize a mix of various specialists and team members, for optimal outcomes.