Incident Response
Incident response (IR) is the structured process of detecting, containing, eradicating, and recovering from a security incident, then conducting a post-incident review to prevent recurrence. The SANS PICERL model defines six phases: Preparation, Identification, Containment, Eradication, Recovery, and Lessons Learned.
Frequently Asked Questions
What is Incident Response?
Incident response (IR) is the structured process of detecting, containing, eradicating, and recovering from a security incident, then conducting a post-incident review to prevent recurrence. The SANS PICERL model defines six phases: Preparation, Identification, Containment, Eradication, Recovery, and Lessons Learned.
How is Incident Response related to SOC (Security Operations Center)?
Incident Response and SOC (Security Operations Center) are both key concepts in threat intelligence. A Security Operations Center is a team (and facility) responsible for continuously monitoring, detecting, investigating, and responding to cybersecurity incidents. SOC analysts rely on threat intelligence, SIEM platforms, and playbooks to triage alerts efficiently.
Related Terms
SOC (Security Operations Center)
A Security Operations Center is a team (and facility) responsible for continuously monitoring, detecting, investigating, and responding to cybersecurity incidents. SOC analysts rely on threat intelligence, SIEM platforms, and playbooks to triage alerts efficiently.
IOC (Indicator of Compromise)
An indicator of compromise is an indicator supported by evidence of compromise or malicious activity. Security teams use IOCs to detect, contain, and investigate threats; an arbitrary IP address, domain, URL, file hash, or email address is only an observable until evidence supports that promotion.
Threat Intelligence
Threat intelligence is evidence-based knowledge about cyber threats, including observed infrastructure, behaviors, campaigns, and likely intent. It combines source observations with context so security teams can make a specific detection, triage, containment, or response decision.
Put this intelligence to work
Query indexed indicators — IPs, domains, URLs, and hashes — in seconds.