Detection and Analysis: Identifying Real Incidents

The detection and analysis phase begins when a potential security incident is first identified and ends when the scope and impact are understood well enough to begin containment. The primary challenge in this phase is distinguishing true positives from false positives — an alert generated by malicious activity from an alert triggered by normal but unusual behavior. Effective detection requires properly configured tools, trained analysts, and documented baselines of normal activity.

Incidents are detected through multiple channels: SIEM alerts generated by correlation rules, EDR detections from behavioral analysis on endpoints, user reports (the most common initial detection for phishing), third-party notification (law enforcement, threat intelligence vendors, breach notification services), automated scanning (vulnerability scanners or CSPM finding anomalies), and threat hunting (proactive investigation). Each source has different reliability levels and provides different types of evidence.

Effective detection requires collecting logs from diverse sources. Critical log types include: Authentication logs (Windows Security Event Log, /var/log/auth.log) for failed/successful logins, Network logs (firewall, VPC Flow Logs, proxy) for unusual connections, DNS logs for queries to known malicious domains, Endpoint logs (EDR, Sysmon) for process creation and file activity, and Cloud audit logs (CloudTrail, Azure Monitor) for API calls. A SIEM aggregates and correlates these disparate sources.

SOC analysts triage hundreds or thousands of alerts daily, most of which are false positives — legitimate activity that triggered a detection rule. A false positive wastes analyst time and creates alert fatigue that causes real threats to be dismissed. A true positive represents actual malicious activity. A false negative is the most dangerous outcome — malicious activity that generated no alert at all. Tuning detection rules to reduce false positives without increasing false negatives is a core SOC skill.

SIEM correlation rules combine multiple individual log events to identify patterns that indicate attacks. Example: one failed login is normal; 100 failed logins from the same IP in 60 seconds indicates brute force. Another example: a user authenticating from the US at 9 AM and then from China at 11 AM is impossible travel — likely a compromised account. Effective correlation rules balance sensitivity (catching real attacks) with specificity (not drowning analysts in noise).

During analysis, responders collect Indicators of Compromise (IoCs) that characterize the attack: suspicious IP addresses, malicious domain names, file hashes of malware, registry keys modified by the attacker, unusual process names or parent-child relationships, and anomalous network connections. IoCs are used to: determine scope (is this IoC present on other systems?), enrich threat intelligence, block further attacker access, and develop SIEM rules to detect similar activity in the future.

Scope analysis answers: What systems are affected? What data was accessed or exfiltrated? How did the attacker get in and when? Responders use log analysis to reconstruct the attack timeline, identify the initial access vector, list all systems the attacker touched (lateral movement), and determine whether data was exfiltrated (outbound transfer spikes, data staging directories). The scope assessment drives containment decisions — you cannot contain what you have not mapped.

EDR (Endpoint Detection and Response) platforms are the primary technical tool for endpoint-level incident analysis. EDR telemetry provides: process execution trees (what spawned what), file system activity, network connections per process, registry modifications, and memory injection detection. During an incident, EDR allows analysts to search across all endpoints for an IoC simultaneously (enterprise-wide hunt), isolate a compromised endpoint from the network, and pull forensic artifacts without physically touching the system.

Network evidence is often the most reliable source during incident analysis. NetFlow and VPC Flow Logs reveal connections between systems without showing payload content — useful for mapping lateral movement. Full packet capture (PCAP) shows complete conversation content including credentials, exfiltrated data, and C2 commands (if traffic is unencrypted). DNS query logs reveal malware beaconing to C2 domains. Responders look for: large outbound data transfers, connections to unusual ports, beaconing patterns (regular connections every N seconds), and internal scanning behavior.

Reconstructing the attack timeline is essential for understanding dwell time (how long the attacker was present before detection), identifying the initial access vector (to close the vulnerability), and preserving evidence in chronological order for legal proceedings. Timelines are built by correlating timestamps across multiple log sources. Time synchronization (using NTP) is critical — logs with incorrect system clocks create gaps and contradictions in timelines that undermine forensic conclusions.

Not every alert requires full CSIRT activation. Analysts use documented criteria to determine escalation triggers: discovery of a confirmed data breach triggers mandatory regulatory notifications and executive escalation. Discovery of malware that has spread beyond one system triggers full CSIRT engagement. A single phishing email (no click) stays at tier-1 analyst level. Well-defined escalation thresholds prevent both over-reaction (wasting resources on minor events) and under-reaction (major breaches growing while treated as minor alerts).

Test your understanding of CompTIA Security+ (SY0-701) concepts from this lesson.

In this lesson you learned: detection relies on diverse log sources aggregated by a SIEM with correlation rules that identify multi-event attack patterns, IoCs collected during analysis are used to scope the incident across all systems and develop blocking rules, and false negatives are the most dangerous outcome because they allow attackers to operate undetected. Next up we explore containment, eradication, and recovery.