Incident response

Incident response (IR) is what an organization does from the moment it suspects a security incident until normal operations are restored and the lessons are written down. Doing it well means deciding in advance who does what, so that nobody improvises under pressure.

The classic lifecycle, from earlier editions of NIST's incident handling guide, has four phases:

1. Preparation: plans, contacts, tools, logging and training in place before anything happens.
2. Detection and analysis: recognizing that an incident is happening and understanding its scope.
3. Containment, eradication and recovery: stopping the spread, removing the attacker's access and restoring systems safely.
4. Post-incident activity: reviewing what happened and improving defenses.

The current revision of NIST SP 800-61 maps incident response to the Cybersecurity Framework 2.0 functions, making it part of everyday risk management rather than a separate emergency procedure. The phases above remain a useful mental model for analysts.

Example

Ransomware is detected on two file servers. The team isolates the servers from the network (containment), identifies and removes the attacker's remote access tool and the compromised account (eradication), restores data from clean backups (recovery), and a week later meets to review why the initial phishing email was not blocked (post-incident activity).

Why it matters for a SOC analyst

Every alert you triage is the start of a potential incident. Knowing the phases helps you act in the right order: understand the scope before you contain, and contain before you clean up, so you do not tip off the attacker or destroy evidence. Write down every action with a timestamp; the report at the end depends on it.