RS.AN Incident Analysis

Statement

Notifications from detection systems are investigated

Statement

The impact of the incident is understood

Statement

Analysis is performed to establish what has taken place during an incident and the root cause of the incident

Guidance

Determine the sequence of events that occurred during the incident and which assets and resources were involved in each event

Guidance

Attempt to determine what vulnerabilities, threats, and threat actors were directly or indirectly involved in the incident

Guidance

Analyze the incident to find the underlying, systemic root causes

Guidance

Check any cyber deception technology for additional information on attacker behavior

Statement

Incidents are categorized consistent with response plans

Statement

Processes are established to receive, analyze and respond to vulnerabilities disclosed to the organization from internal and external sources (e.g. internal testing, security bulletins, or security researchers)

Statement

Actions performed during an investigation are recorded, and the records' integrity and provenance are preserved

Guidance

Require each incident responder and others (e.g., system administrators, cybersecurity engineers) who perform incident response tasks to record their actions and make the record immutable

Guidance

Require the incident lead to document the incident in detail and be responsible for preserving the integrity of the documentation and the sources of all information being reported

Statement

Incident data and metadata are collected, and their integrity and provenance are preserved

Guidance

Collect, preserve, and safeguard the integrity of all pertinent incident data and metadata (e.g., data source, date/time of collection) based on evidence preservation and chain-of-custody procedures

Statement

An incident's magnitude is estimated and validated

Guidance

Review other potential targets of the incident to search for indicators of compromise and evidence of persistence

Guidance

Automatically run tools on targets to look for indicators of compromise and evidence of persistence