Typorithm · medium

Incident Response

incident-responsesecurityiocplaybook

Saved on this device

Full lesson · 8 learning steps Open any exercise for focused practice

Step 1 of 8 · intro card

Learn Incident Response

Blue Team & SOC

The SANS/NIST incident-response lifecycle runs preparation, identification, containment, eradication, recovery, and lessons learned. Analysts hunt indicators of compromise (IOCs), preserve evidence (chain of custody), and rehearse with tabletop exercises.

Incident response follows a defined lifecycle (SANS and NIST describe nearly the same phases): preparation, identification, containment, eradication, recovery, and lessons learned. Each phase has a clear job, from building playbooks up front to writing a postmortem at the end.

During an incident, analysts hunt indicators of compromise (IOCs) — hashes, IPs, domains, or file names tied to the attacker — to detect and scope the breach. They contain affected hosts, eradicate the malware, and recover from a clean state.

Evidence must be preserved with a chain of custody so it holds up later, and teams rehearse the whole process with tabletop exercises — walking through a simulated incident — so the real one is not the first time the playbook is used.

Lifecycle: prepare, identify, contain, eradicate, recover, learn.

Hunt IOCs (hashes, IPs, domains) to detect and scope.

Preserve evidence with chain of custody; rehearse with tabletops.

ir_phases:
  preparation: tooling-and-playbooks
  identification: detect-and-scope
  containment: isolate-host
  eradication: remove-malware
  recovery: restore-clean
  lessons_learned: postmortem

Read the implementation

Connect each part of the code to the concept before you type.

1. Prepare

Preparation builds the tooling and playbooks before an incident so the team can move fast.

preparation: tooling-and-playbooks

2. Identify

Identification detects the incident and scopes which systems and accounts are affected.

identification: detect-and-scope

3. Contain

Containment isolates affected hosts to stop the attack from spreading.

containment: isolate-host

4. Eradicate

Eradication removes the malware and the attacker's foothold from the environment.

eradication: remove-malware

5. Recover

Recovery restores systems from clean state and returns them to normal operation.

recovery: restore-clean

6. Learn

Lessons learned runs a postmortem so the team improves before the next incident.

lessons_learned: postmortem

A complete learning loop

Understand

Read the concept map and follow the code breakdown.

Reconstruct

Type the implementation, repair mistakes and work through every recall exercise.

Verify

Use the final check without hints; revisit weak concepts in short practice sessions.