Incident Response
Incident response (IR) is the structured process of detecting, containing, eradicating, and recovering from a security incident, then conducting a post-incident review to prevent recurrence. The SANS PICERL model defines six phases: Preparation, Identification, Containment, Eradication, Recovery, and Lessons Learned.
Incident response is what a security team does between “something is wrong” and “it is over and we know why”. The phases are well known: prepare tooling and roles, identify the incident and its scope, contain it so it stops spreading, eradicate the attacker’s foothold, recover the affected systems, and record what would have caught it earlier.
Most of the elapsed time is spent in identification and containment, and both run on indicators. The responder has an address in a proxy log, a domain in an e-mail header, a hash on a disk, and needs to know within minutes whether each is known-bad, known-good or unknown, and what else it is connected to.
Threat intelligence shortens that loop. A reputation lookup with source history turns an unknown address into “C2 for this family, first seen three weeks ago, still active”, which decides the containment step. Without it, every indicator is investigated from zero.
Example
An EDR alert names a process beaconing to a domain. The lookup shows the domain was registered nine days ago, resolves to an address on a bulletproof host and is listed by two C2 trackers. The host is isolated in the first ten minutes instead of after a day of log review.
In isMalicious
The report page is built for this loop: reputation first, then WHOIS, DNS, hosting and related indicators as they arrive, so a responder gets a verdict before the enrichment finishes. Saved reports keep the evidence for the post-incident review.
Frequently Asked Questions
What is Incident Response?
Incident response (IR) is the structured process of detecting, containing, eradicating, and recovering from a security incident, then conducting a post-incident review to prevent recurrence. The SANS PICERL model defines six phases: Preparation, Identification, Containment, Eradication, Recovery, and Lessons Learned.
How is Incident Response related to SOC (Security Operations Center)?
Incident Response and SOC (Security Operations Center) are both key concepts in threat intelligence. A Security Operations Center is a team (and facility) responsible for continuously monitoring, detecting, investigating, and responding to cybersecurity incidents. SOC analysts rely on threat intelligence, SIEM platforms, and playbooks to triage alerts efficiently.
Related Terms
SOC (Security Operations Center)
A Security Operations Center is a team (and facility) responsible for continuously monitoring, detecting, investigating, and responding to cybersecurity incidents. SOC analysts rely on threat intelligence, SIEM platforms, and playbooks to triage alerts efficiently.
IOC (Indicator of Compromise)
An indicator of compromise is an indicator supported by evidence of compromise or malicious activity. Security teams use IOCs to detect, contain, and investigate threats; an arbitrary IP address, domain, URL, file hash, or email address is only an observable until evidence supports that promotion.
Threat Intelligence
Threat intelligence is evidence-based knowledge about cyber threats, including observed infrastructure, behaviors, campaigns, and likely intent. It combines source observations with context so security teams can make a specific detection, triage, containment, or response decision.
Put this intelligence to work
Query indexed indicators — IPs, domains, URLs, and hashes — in seconds.