19.2 Detection, Reporting, and Containment Basics
Detection Is a Funnel, Not an Alarm
Detection sources stack: SIEM correlation rules, EDR process telemetry, network IDS signatures, honeypots, file-integrity monitors — and the most underrated sensor, a human who reports something odd. A raw alert is a hypothesis, not an incident. An analyst must validate it first: was that encoded PowerShell a legitimate admin script or the payload of a macro? Validation is the first defense against alert fatigue, because when everything escalates, the pager gets muted — and a muted pager is how breaches accumulate dwell time.
Reporting Has a Path and a Clock
The runbook fixes who notifies whom, and within what SLA. The analyst pages the IR lead; severity picks the rest of the distribution list — system owners for a P2, legal, comms, and executives for a P1. One channel owns the incident record: a ticket opens the moment the page goes out, and every decision lands in it. Ad-hoc side chats are where incident timelines go to die.
Isolate — but Do Not Pull the Plug
Containment forces a tradeoff: cut the host off, or power it down. Power-off is the wrong default. It destroys RAM-resident evidence — encryption keys, injected code, live sessions, malware pieces that never touched disk — and can trip anti-forensic dead-man switches, including ransomware that accelerates encryption when its beacon goes quiet. Network isolation — a switch port shut, a quarantine VLAN assignment, a NAC policy, or an EDR "network contain" command — severs propagation and command-and-control while the machine stays alive for capture. Capture volatile data before changing host state, in order of volatility: memory image, running processes, logged-on users, active network connections, then disk. Two cautions: a full-disk-encrypted host should be screen-locked but left running, since sleep or hibernation reseals the keys; and log every action with a timestamp as you take it.
Stop the Spread
One quarantined host is not containment if the infection walks. Block known command-and-control destinations at the proxy and firewall, disable compromised accounts and force credential resets, then sweep the rest of the estate for the same indicators of compromise before anyone says the word "contained."
Architecture Diagram
Key Takeaways
- Alerts are hypotheses; validate before escalating, or alert fatigue mutes the page that actually matters.
- The notification path and SLA live in the runbook: severity picks the distribution list, and a ticket opens immediately.
- Prefer network isolation over power-off: it halts propagation and preserves RAM-resident evidence.
- Capture volatile data in order of volatility — memory first — before changing host state; lock but keep encrypted hosts running.
- Containment is complete only after blocking C2, resetting abused accounts, and sweeping the estate for the same IoCs.