Orientation: Reading an Incident

The incident board

The six elements are the periodic table of this course, and the board lays them out in the one arrangement that shows how they act on each other, so read it as a mechanism rather than a poster. Start at the top left with the estate map, which answers the second question — how far did it reach, and since when? It shows only what matters to this incident: the internet on the left, the three hosts that were reached, and the five zones that were not. The attacker never appears as a person or a tool, only as a path — a sequence of traces that the defenders later found in their own records — and each step of the path carries the name of an ATT&CK tactic. MITRE ATT&CK is a public knowledge base that names what intruders try to achieve (the tactics, such as initial access or exfiltration) and the general ways they do it (the techniques, such as Exploit Public-Facing Application or Valid Accounts). For a defender its value is a shared vocabulary: the analyst, the MDR, the incident response firm and the board can talk about the same step in the same words, and each named step points to the controls and detections that would stop or reveal it. That is the only level at which this course discusses attacker behaviour. The green bars across the path are the containment cuts: each one closes a part of the path at a recorded time, and the order in which they fall is one of the most consequential decisions in any incident, because some cuts destroy evidence if they come too early and some let data keep leaving if they come too late. The ticked muted boxes matter as much as the red ones. An incident lead who can say only "these hosts were compromised" has half an answer; the other half is "and these were searched and show no evidence of access, at this confidence" — the claim that lets a plant keep running and lets a notification say what was not affected. Below the map runs the timeline ruler, which serves the first question — what happened, and how do we know? — because a timeline built from evidence is how a team moves from impressions to an account it can defend. Its first bar is the one nobody saw at the time: dwell, the stretch between the first malicious event and detection. Mandiant's annual M-Trends reports have tracked how long intruders stay unseen; the median they report has fallen from many months a decade ago to days or a few weeks in recent editions, which is progress, but it is still time in which records age out and data can be taken. The other bars — detect, scope, contain, eradicate, recover, learn — show the phases of the response; they overlap, because scoping continues while containment begins, and the loop runs backwards whenever new evidence widens the scope. On the right stands , which answers the third question — Each card is one source with three chips: what kind of record it is, that a (a mathematical fingerprint, here SHA-256) was taken when it was acquired so that any later alteration would show, and that a form records who held it, when and why. The principle that decides what goes on the shelf first is the set out in (2002): collect what disappears soonest — the contents of a running machine's memory, live network connections — before what lasts, such as disks and archived logs. describes the identification, collection, acquisition and preservation of digital evidence, and (2006) describes how forensic techniques fit into incident response; this course works at their level, never at the level of a tool's command line. The shelf sits under counsel's , the instruction that nothing relevant is deleted, overwritten or rotated away while the matter is open. Finally, the answers the fourth question — — through its last stage, , which feeds back into . The loop is a working synthesis rather than a quotation. (2012) described a life cycle of preparation; detection and analysis; containment, eradication and recovery; and post-incident activity. , published in , replaced it and organises its incident response recommendations around the six functions of the NIST Cybersecurity Framework . The model names six steps — preparation, identification, containment, eradication, recovery and lessons learned — and sets out incident management as an organisational process. What they share, and what this board depends on, is that preparation is work in its own right and that what is learned feeds back into it. Each later module lights one part of the board: Module 3 with the plan and its roles; Module 4 the signal and the step that declares an incident; Module 5 the estate map, scoped; Module 6 the evidence shelf; Module 7 the timeline ruler; Module 8 what each host recorded; Module 9 the containment cuts; Module 10 the eradicate and recover bars; Module 11 the notification clocks; Module 12 and the rules it changes; and Module 13 the whole board.

Traced instance: one intrusion, from Day −6 to Day 21. The readiness programme came first, and it shaped every hour that followed. In Readiness Month 1 the CFO approved an incident response plan (PP1) with severity levels Sev1–Sev3, a rule that the security lead — or the analyst as deputy — declares an incident, and a list of roles; and a log review (PP5) confirmed the 90-day central retention and produced a gap list of systems that did not forward their logs. In Month 2 came a retainer with Tamsen Incident Response, a fictional firm, for remote response within 4 hours (PP2); an evidence kit and procedure (PP4) — memory capture through the MDR agent, disk imaging, SHA-256 hashing, custody forms and a locked evidence store; and an out-of-band channel (PP6), a phone tree and a separate messaging group that does not depend on Kestrel's email or identity systems. Over Months 2–3 the analyst wrote playbooks for six scenarios (PP3): ransomware, data theft, account takeover, payment fraud, insider misuse and plant or OT disruption. In Month 3 the board agreed decisions in advance (PP7): the plant manager, with the security lead, decides whether production systems are isolated; the extortion stance is no payment by default, and the board decides; and notification thresholds are set with external counsel. In Month 4 a tabletop exercise on a data-theft scenario (PP8) found that the call chain to counsel was too slow, and a named duty contact fixed it. The intrusion began in the gap between a patch and its installation. On Day −16 the vendor of HS1's software published an advisory and a patch for a publicly disclosed critical vulnerability; under the 14-day SLA (K5) the patch was scheduled for the Day −2 maintenance window and had not yet been applied when the first malicious activity reached HS1 at Day −6 05:12 — a fact established later from HS1's own logs and the flow records. Kestrel was inside its own policy; the policy was too slow for a system facing the internet. Read as tactics, the path ran like this. : exploitation of the appliance (the technique ATT&CK calls ). : a 's credentials stored in HS1's configuration — an account with domain-wide rights far beyond its job. with that account to HS2 at and to HS3 at . : about gathered into archives on HS3 between — design files for one servo-drive product line, and a forgotten folder of holding the names and home addresses of about , left on the engineering share by an old project. to an external cloud-storage address from . At the MDR raised an alert on the combination it was built to notice: unusual outbound volume from HS3 and archive creation by a service account at night. The MDR phoned the on-call analyst at ; the security lead and opened the incident record; the CFO was informed at ; and Tamsen, activated at , was working remotely by and on site on . The containment cuts fell in a deliberate order. at blocked the destination addresses at the firewall, which stopped the exfiltration. at captured HS3's memory through the MDR agent () at isolated HS3 from the network, left powered on. at cut HS1 from the internet and moved it to an isolated network, still powered on for imaging. at disabled the service account, reset its password and revoked its sessions. at isolated HS2, once scoping showed the account's logon there. External counsel was engaged at and placed a that day. Eight evidence items were acquired, each hashed with SHA-256 and logged on a custody form: the MDR's endpoint telemetry export (90 days), HS3's memory image, HS3's disk image (), HS1's disk image with its local logs — HS1 kept only of logs locally and did not forward them — HS2's disk image, the firewall and flow logs (90 days), the domain controllers' authentication logs (90 days), and the archive listings recovered from HS3. The flow records showed leaving between 02:52 and 03:52; the archive listings showed which files had been staged; at file level. The assessment followed the evidence: part of the design archive left; whether the HR-exports archive left is , so it was . By Tamsen and the analyst had the scope: three hosts compromised, one account misused, one on HS2 set to relaunch a remote-access tool (persistence), and a malicious file on HS1, which was preserved, hashed and analysed by Tamsen's specialists. There was of access to plant OT, Brask, Brenholt, email or the distributor portal — confidence on Day 2 and on , after the full estate search. Dwell time was . Eradication and recovery took five days: HS2 rebuilt on ; HS1 rebuilt from the vendor's clean image, patched, and its administration interface no longer reachable from the internet on ; HS3 rebuilt and its data restored from the immutable backups (K4) in about , checked against the pre-incident file inventory, on ; the passwords of all rotated and the misused account replaced by a least-privilege one over . HS3 was back on and HS1 on , under heightened monitoring for , with no sign of return. The notices went out on time. The board was briefed at and the cyber insurer notified at ; the police received a report on . Under national rules modelled on NIS2 (illustrative), the national CSIRT received an early warning at , a notification at and a final report in ; the data-protection authority was notified at , inside 72 hours. The employees were told on , with an FAQ and a helpline, and all staff were briefed the same day; the two customers whose drawings had passed through HS1 were informed on . Also on an email claimed the data and demanded payment. Under PP7 the board decided ; the email was preserved as evidence and passed to the police; and Northlight watched for the data, which was (fact). On the metrics were recorded: dwell time about ; alert to declaration ; declaration to the main containment action, CA5, ; HS3 back in ; a cost of about (illustrative: Tamsen, counsel, overtime, notification and rebuild), partly covered by insurance, with the settlement still open. The same day a , chaired by the security lead with Tamsen, took six decisions: critical patches on internet-facing systems within , with the 14-day SLA kept for the rest; service accounts on least privilege, with no domain-wide rights and credentials held in a vault, and all 37 reviewed; every appliance and application log forwarded to the central store, so that no system keeps logs only locally; personal data out of engineering shares, with a quarterly scan of file shares for personal data; playbooks that capture memory before isolating a server where it is safe to do so, and a new detection rule for egress volume; and a second tabletop in on the extortion decision and the notification clocks. The review also wrote down what went well: the MDR's alert, the declaration within the hour, memory captured before isolation, every notification inside its deadline, no payment, and plant OT untouched. Notice what the board does show: no name for the intruder — the board records traces, not guesses (B4) — and no tick on any zone that had not been searched.

From firefighter to investigator-responder

The gap between the two views is the whole value of the course, and it is worth being fair to the firefighter first. The firefighter is usually brave, skilled and exhausted: someone who cares about the systems, sees something burning, and does what instinct says — put it out, now. Executives often reward it, because a server switched off at 4 a.m. looks like action and a memory capture looks like delay. The trouble is structural, and each habit fails in a specific way. No plan means the first hour is spent deciding who decides; Kestrel's baseline at Readiness Month 0 was exactly this, and the Brenholt incident had been handled ad hoc. Everyone jumps in means several people change the same hosts at once, so that nobody can later say which change was the attacker's and which was a colleague's. No notes means that the timeline has to be rebuilt from memory, and memory under stress is the least reliable source there is. Wipe and reimage at once feels decisive but destroys the record of how the intruder arrived and what else they touched; on Kestrel's case, wiping HS1 on Day 0 would have erased its 7 days of local logs, the host's own record of the entry. Evidence trampled — rebooted machines, browsed folders, copied files with their dates changed — leaves nothing that will stand up when an insurer, a regulator or a court asks how you know. Scope guessed misses what was not obvious: the scheduled task on HS2, the jump server nobody was looking at, would have survived a response that cleaned only the server that raised the alert. "We think it's fine" is a premature all-clear, issued before every credential the attacker could have touched has been rotated. Someone blamed — whoever had not yet applied the patch, the project that left the HR exports on the share — teaches everyone to hide the next warning, and it misreads a system failure as a personal one: the patch was inside Kestrel's own 14-day policy. Regulators told late, or not at all, turns one failure into two, and the second one is the organisation's own. And the same hole next year is what happens when a review produces a document rather than decisions. The public record shows each pattern and its opposite, at the level the public sources support. In the Target breach of 2013, security alerts were reportedly raised but not acted on in time — a detection that existed without a response that used it. In the Uber breach of 2016, concealment became the larger story: its former chief security officer was convicted in the United States in over concealing the breach. On the other side, when struck in , the company rebuilt its network, reportedly helped by a domain controller that had survived offline in Ghana — a reminder that recovery depends on something trustworthy to recover from, as Kestrel's immutable backups were. , hit by ransomware in , switched to manual operations and was widely praised for communicating openly. shut its pipeline as a precaution after ransomware in , a precautionary containment decision that reached well beyond the IT systems. And the compromise of came to light when investigated its own breach — one organisation's investigation of its own breach uncovered a far wider compromise. The replaces each habit with a discipline. It works from , so that at 03:41 the security lead knew the declaration was theirs to make (PP1) and the call chain to counsel had already been fixed in a tabletop (PP8). It : 43 minutes from alert to Sev1, because declaring an incident costs little and declaring it late costs a great deal. It keeps , opened at the declaration, into which every decision and its time goes. It : CA1 stopped the data leaving within 11 minutes of the declaration, while HS1 and HS3 were isolated but left powered on. It : HS3's memory was captured at 04:05, fifteen minutes before its isolation at 04:20. It and says how sure it is — moderate on Day 2, high on Day 5 — and it says where the evidence stops, as it does about which staged files left. It before it trusts: all 37 service accounts, three hosts rebuilt, 30 days of heightened monitoring. It , inside every deadline. It holds . And it ends with , RD1 to RD6, so that the path through HS1 does not work again. What the contrast makes concrete is this: the firefighter's Day 0 ends with HS3 wiped, its memory lost, HS1's log erased and HS2's scheduled task still waiting; the investigator-responder's ends with the data flow stopped, eight hashed evidence items on the shelf, and a scope that could be stated to a regulator at a named confidence.

The method — thirteen rungs

The course is thirteen modules, and their order follows the response loop with one deliberate exception: the discipline comes before any technique, because the first thing a responder must settle is not what to do but what they are allowed to do, and in what order. After this orientation, Module 2, The Responder's Discipline & Boundary, installs six commitments that govern everything else, tagged B1–B6 and cited by those tags throughout. B1, lawful authority and scope: investigate only the systems and data you are authorised to examine, never act against systems you do not own, and study attacker behaviour only as traces. B2, evidence integrity: preserve before you change, capture in order of volatility, hash, record and keep custody, and never alter originals. B3, privacy and proportion: look at personal data only as far as the investigation needs; staff are witnesses, not suspects, unless evidence says otherwise. B4, honest uncertainty: separate fact, assessment and speculation, state what is not known, and attribute nothing prematurely. B5, safety and continuity first: containment proportionate to the harm, and decisions about plants and production taken with their owners. B6, duties to others: notify regulators, the people affected, insurers, police and partners on time and truthfully, and never conceal. Module 2 is a gate: the rest of the course assumes it. Module 3, Preparation — the Plan, the Roles and the Kit, is the only phase done calmly: the incident response plan with its scope, severity levels and the rule for who declares (P1); roles — incident lead, deputy, scribe, technical leads, communications and legal (P2); playbooks for the likely scenarios (P3); the retainer and third parties — the incident response firm, the MDR, counsel and the insurer (P4); readiness of logs, tools and the evidence kit (P5); and tabletop exercises with decisions agreed in advance (P6). Module 4, Detection & Triage — From Alert to Declared Incident, covers where detection comes from — alerts, people, partners and outsiders (T1); the first triage questions: is it real, how bad, is it spreading? (T2); severity and the decision to declare (T3); the first hour — who is called and what is written down (T4); false positives and alert fatigue (T5); and the incident record, one log that every decision goes into (T6). Module 5, Scoping — What, Where and Since When, covers the scoping questions about hosts, accounts, data and time (S1); indicators of compromise and searching the estate for them (S2); attacker behaviour read as ATT&CK tactics, from the defender's side (S3); dwell time and the first malicious event (S4); proving what was not touched (S5); and scope confidence as it changes (S6). , covers what counts as digital evidence (E1); the order of volatility from RFC 3227 (E2); acquisition of memory, disk, logs and cloud records at the level a lead directs (E3); hashing and integrity (E4); chain of custody and legal hold (E5); and working on copies, with notes that hold up (E6). , covers the log sources and the question each answers — authentication, endpoint, network, application and cloud (L1); time, clocks, time zones and normalisation (L2); building the timeline from events to a story (L3); gaps in the record, retention and missing sources (L4); reading authentication and privilege use (L5); and network and egress evidence of how much left, and where to (L6). , covers what a system records about programs, logons and files, in general terms (A1); what exists only in memory while a machine runs (A2); finding what was set to come back (A3); malicious files — preserve, hash, isolate and hand to specialists (A4); cloud and SaaS audit logs and their retention (A5); and reading a forensic report as a decision-maker (A6). , covers the goals and trade-offs between speed, evidence and business (C1); network containment — isolating hosts and blocking egress (C2); account containment — disabling, resetting and revoking sessions (C3); short-term and long-term containment (C4); plants and production, and who may stop a line (C5); and watching for the attacker's reaction (C6). , covers removing every foothold found in scoping (R1); deciding between rebuilding and cleaning (R2); rotating every credential and secret the attacker could have touched (R3); recovery from trusted backups, course 014's K4 (R4); return to service under heightened monitoring (R5); and declaring the incident closed (R6). , covers internal communication with the board and staff over out-of-band channels (N1); regulators — the GDPR's 72 hours and NIS2's 24 hours, 72 hours and one month (N2); the people whose data is affected, what to tell them and when (N3); insurers, police, partners and customers (N4); extortion demands — a decision agreed in advance, with no negotiation craft (N5); and honesty under pressure and the cost of concealment (N6). , covers the blameless review (W1); root and contributing causes — what failed, and why (W2); the incident metrics of dwell time and time to declare, contain and recover (W3); findings turned into owned, dated actions (W4); updating playbooks, detections and course 017's threat model (W5); and the report for the board and the file (W6). , runs the whole method on Kestrel's intrusion in six stages — preparation; detection and triage; scoping and evidence; containment, eradication and recovery; communication and notification; and the Day 21 review — and compresses it into a master equation and a self-assessment. Every module from 2 to 12 is built the same way: six , the sub-techniques of its rung, each with a tag (Module 3's P1–P6, Module 9's C1–C6, and so on) and each dissected through six fixed fields — it is, its (drawn on the incident board), the as a numbered procedure, its and failure modes, to use it and when not, and it connects to the rest. Kestrel is traced through every atom with labels that never collide with the atom tags: readiness items , hosts , evidence items , containment actions and review decisions , with clock times written as "Day 0 03:41" and days before detection as negative numbers. Earlier courses are cited by course: course 014's controls such as (backups), (patching) and (the MDR and central logs), course 016's segmentation, course 017's threat model and distributor portal, course 018's outside monitoring, and course 020's report button and blameless culture. The world is fictional so that a whole incident — the gaps, the uncertainty and the cost included — can be shown without exposing any real organisation or real people; Kestrel's people are named by role only, and Tamsen Incident Response and Northlight Intelligence are fictional. Real-world material — frameworks, standards, laws, reports and public cases — stays at the level the public record supports, and the course invents no statistics.

How to read this course

This is a dissection course, not a war story: every technique is broken down to its mechanism and its procedure, so that you finish not with a memory of one dramatic night but with a repeatable way to run any incident — and to explain your decisions to the people who must approve, fund and live with them. Three things to hold onto as you go. First, preserve before you change. Almost every irreversible mistake in incident response is a change made before the evidence was secured: a reboot that empties memory, a wipe that erases a log, a clean-up that removes the only copy of the attacker's persistence. Kestrel captured HS3's memory before isolating it and left HS1 powered on for imaging; RD5 makes that order the rule. Where safety or the continuing loss of data demands an immediate cut — CA1 came before the memory capture, because data was leaving — make the cut, and write down what it cost (B2, B5). Second, separate what you know from what you think, and say what is not known. The staged files are a fact; the 4 GB that left is a fact; which files were in those 4 GB is not known, so Kestrel treated the HR-exports archive as affected and told the 140 employees on Day 3, rather than gambling on an assessment it could not prove. A responder who says "not known" early is believed later (B4). Third, decide before the night. The hardest calls in an incident — who declares, who may stop a production line, whether to pay an extortionist, when counsel is called and when the regulator is told — are the ones that go worst when they are improvised at 3 a.m. Kestrel's board decided the extortion stance in Readiness Month 3, so the Day 4 demand was met with a decision rather than a debate (PP7). One note on scope: the course teaches method, not any jurisdiction's law. It describes the duties that frame most incidents at the level of their public text — the GDPR's Article 33, which requires notifying the supervisory authority without undue delay and, where feasible, within 72 hours, and its Article 34, which requires telling people when the risk to them is high; NIS2's Article 23, with an early warning within 24 hours, a notification within 72 hours and a final report within one month; and, for companies under its reach, the US SEC's 2023 rule requiring disclosure of a material cybersecurity incident on Form 8-K Item 1.05 within four business days of determining that it is material — and wherever a question turns on what the law requires of your organisation, the course's answer is to take it to counsel, before the incident as well as during it. Hold those three and the rest is detailed machinery. Module 2 makes the discipline explicit first, because a responder is trusted with an organisation's evidence, its people's data and its account of itself, and that trust has to be earned before the first alert.