Simple explanation
This lesson covers the first real work of incident response — confirming something is actually happening, and understanding its scope, by reading the symptoms across different parts of the environment.
Technical explanation
Detection and analysis draws on recognizing symptoms across multiple layers simultaneously:
- Network-related symptoms — unusual traffic patterns, unexpected connections, DNS anomalies, bandwidth spikes.
- Endpoint-related symptoms — unexpected processes, unauthorized software, unusual resource consumption, suspicious file changes.
- Application-related symptoms — abnormal application behavior, unexpected new accounts, service interruptions.
- OS-related symptoms — unauthorized configuration changes, suspicious scheduled tasks, unexpected privilege changes.
The analyst's job during this phase is to correlate symptoms across these layers into a coherent picture: is this actually an incident, and if so, what's its scope (how many systems, what data, how long has it been happening)? This determines everything that follows — you can't properly contain something you haven't yet scoped.
Key analysis principle: don't jump straight to containment before understanding scope — premature action can tip off an attacker, destroy evidence, or address only part of a larger compromise while leaving the rest untouched.
Synonyms / related terms
| Term | Means | |---|---| | Scoping | Determining the full extent of an incident | | IOC | Indicator of Compromise — what's being matched against during analysis | | Triage | The initial process of confirming and prioritizing a potential incident |
Concept Check
"An analyst immediately isolates the first affected workstation the moment ransomware is detected, without checking whether other systems are also affected." While isolation isn't wrong in principle, doing it as the very first action — before any scoping — risks missing that the ransomware has already spread elsewhere, leaving other compromised systems untouched while the team believes the incident is contained.
Interview-style Q&A
Q: Why analyze symptoms across network, endpoint, application, and OS layers together rather than each in isolation? A: "A sophisticated attack rarely shows up cleanly in just one layer. A single endpoint alert might look like noise on its own, but correlated with an unusual outbound network connection and an unexpected new application account, it becomes a clear, high-confidence signal. Looking at layers in isolation is how real incidents get dismissed as false positives."
Memory trick
"Scope before you Stop" — the core discipline of this phase: fully understand an incident's extent before taking action that could limit your ability to see the rest of it.