Incident Response, Digital Forensics, and Threat Hunting
Responding Under Pressure
Incident Response and Forensics
Incident response coordinates containment, eradication, recovery, and lessons learned, while digital forensics preserves and interprets evidence. A mature program balances speed with evidentiary rigor so that response actions do not destroy critical artifacts.
Response Phases
Incident Response vs Threat Hunting
Incident Response
- Triggered by known or suspected compromise
- Goal is containment and recovery
Threat Hunting
- Proactive and hypothesis-driven
- Goal is to discover hidden adversaries
Which activity is most important before making destructive containment changes?
Preserving evidence is critical for later analysis, attribution, and root-cause understanding.
Correct answer: Preserving evidence
What is the purpose of threat hunting?
Threat hunting goes beyond alert-driven response to uncover stealthy activity.
Correct answer: To proactively search for hidden compromise using hypotheses, telemetry, and adversary patterns.
A Practical Response Sequence
-
1
Step 1: Triage the alert and validate the incident.
-
2
Step 2: Contain impact while preserving evidence.
-
3
Step 3: Collect volatile and non-volatile artifacts.
-
4
Step 4: Determine initial access, persistence, and lateral movement.
-
5
Step 5: Restore operations and document remediation.
Which artifact is typically considered volatile evidence?
Volatile evidence such as memory and live network connections can disappear quickly if not captured.
Correct answer: Memory contents
Forensic Caution
Containment actions can alter evidence, so investigators must balance operational urgency with chain-of-custody requirements.