Incident Lifecycle
The Incident Response Lifecycle defines the phases for managing a security incident from preparation through to post-incident review. It provides a consistent, repeatable process to ensure incidents are contained, eradicated, and recovered from effectively, while also capturing lessons to improve future response capability.
1. Preparation
Preparation establishes the readiness of both ThreatDefence and the Customer to respond effectively to incidents.
Customer Responsibilities:
Deploy the required ThreatDefence tools to provide visibility across the environment.
Ensure all contact details (phone numbers, email addresses, roles) are accurate and up to date.
Ensure nominated personnel are familiar with their responsibilities during an escalation.
Provide ThreatDefence with explicit authorization to perform endpoint and/or user isolation if required.
2. Detection and Analysis
ThreatDefence continuously analyzes telemetry from multiple sources, including anomalous behavior, suspicious activity, endpoint detections, threat hunting findings, automated alerts, and customer-reported issues.
Triage Process:
Automated Analysis: AI Assistant applies correlation, pattern recognition, and reasoning to reduce noise.
Contextual Review: SOC analysts validate detections, checking whether the activity is expected or suspicious.
Correlation: Detections are compared against related telemetry and threat intelligence to determine scope.
Severity Confirmation: Initial severity may be adjusted. Critical detections are escalated immediately.
Decision: SOC determines whether the detection should be closed, noted, or escalated.
Possible Outcomes:
Alert Closure – benign activity, false positive, or expected behavior.
SOC Notification – informational, low-severity notification sent to the customer.
Incident Declaration – malicious or credible threat requiring immediate response.
3. Incident Declaration and Escalation
An Incident Declaration is made when activity is assessed as a credible threat requiring immediate response.
If confirmed as malicious, a major incident is declared, and all stakeholders from ThreatDefence and the Customer are notified per the escalation matrix.
ThreatDefence declares an incident if there is reasonable suspicion of compromise.
Customers can also trigger Incident Response directly by contacting the SOC phone line or requesting escalation during an investigation.
4. Threat Containment
The SOC team acts to minimize impact and stop the threat.
ThreatDefence Actions:
Isolate affected endpoints (via agent).
Disable compromised accounts in Entra ID (Microsoft 365).
Customer IT Actions (with SOC guidance):
Rotate credentials for affected accounts.
Block identified indicators of compromise (files, processes, registry keys).
Shut down affected systems to prevent further spread.
Block or restrict specific network traffic.
5. Eradication and Recovery
Once contained, the SOC and Customer teams focus on removing malicious artifacts and restoring systems.
Root Cause Analysis: Confirm the attack vector and identify persistence mechanisms.
Artifact Removal: Eliminate malware, scripts, or unauthorized accounts.
Credential Actions: Reset or disable compromised accounts.
System Rebuilds: Re-image affected systems if required.
Recovery Phase:
Verify endpoints and services are clean.
Validate security controls are functioning.
Reconnect systems to the production network under SOC supervision.
6. Post-Incident Activities
After resolution, a structured post-incident review may be conducted to capture lessons and strengthen processes.
Lessons Learned:
Review attack vector, detection timelines, and response effectiveness.
Identify weaknesses in processes, tools, or communications.
Ensure all parties contribute to a complete picture of the incident.
Improvements:
Provide recommendations to improve endpoint protection, policies, or access controls.
Update incident response playbooks with findings.
Strengthen security posture to improve efficiency in future incidents.
The Incident Response Lifecycle ensures that both ThreatDefence and Customers have a repeatable, well-defined process for managing incidents, minimizing risk, and continuously improving operational resilience.
Last updated