Incident Response Lifecycle: NIST 800-61 Phases and Tools

NIST Special Publication 800-61 (Computer Security Incident Handling Guide) defines the standard framework for incident response. The four phases are:

Preparation — the most critical phase. Establish incident response policies, form the CSIRT (Computer Security Incident Response Team), acquire tools (forensics kits, imaging devices, analysis software), and conduct training and tabletop exercises.

Detection and Analysis — monitor systems for security events, validate whether an event is actually an incident, determine the scope (what systems are affected), assess the impact, and document everything. This is where SIEM tools play a crucial role.

Containment, Eradication, and Recovery — contain the incident to prevent further damage (short-term containment: isolate affected systems; long-term containment: apply temporary fixes), eradicate the root cause (remove malware, patch vulnerabilities, rebuild systems), and recover by restoring systems to normal operation.

Post-Incident Activity (Lessons Learned) — conduct a post-mortem meeting, document what happened and what was learned, update policies and procedures, and create a final incident report.

SIEM systems collect, aggregate, and analyze log data from across the enterprise to detect security incidents in real-time. SIEM combines two functions: Security Information Management (SIM — long-term log storage and reporting) and Security Event Management (SEM — real-time monitoring and alerting).

SIEM tools ingest logs from firewalls, servers, endpoints, applications, and network devices. They correlate events across multiple sources to identify patterns that indicate attacks. For example, a SIEM might correlate failed logins across multiple domain controllers with a subsequent successful login from an unusual location — indicating a potential password-spraying attack.

SOAR platforms build on SIEM capabilities by automating incident response actions. SOAR can automatically: enrich alerts with threat intelligence, run playbooks (predefined response workflows), open tickets in ITSM systems, block indicators on firewalls, and quarantine endpoints.

While SIEM detects incidents, SOAR responds to them. SOAR reduces mean time to respond (MTTR) by automating repetitive analysis and response tasks, allowing human analysts to focus on complex investigations.

Digital forensics is the process of collecting, preserving, analyzing, and presenting digital evidence. The forensic process must maintain the integrity of evidence for potential legal proceedings.

Chain of Custody is the documented history of evidence — who collected it, when, where, how it was handled, and who had access. Every transfer must be documented. Break the chain and the evidence may be inadmissible in court.

Forensic principles: never work on the original data (always create a forensic image), use write blockers to prevent modifying evidence, document every action, and maintain integrity through hashing (verify the forensic image matches the original).

Threat hunting is the proactive search for threats that evaded existing security controls. Unlike incident response (which reacts to alerts), threat hunting assumes a breach has already occurred and actively looks for indicators.

The threat hunting process: (1) Create a hypothesis based on threat intelligence or known TTPs, (2) Collect and analyze data from logs, network traffic, and endpoints, (3) Investigate suspicious findings, (4) Respond if a threat is confirmed. The results improve detection rules and reduce future dwell time.