thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Operations · Foundational

Detection and Analysis

The incident response phase focused on identifying potential incidents, validating them and determining scope and impact.

Definition

Analysts review alerts, precursors and indicators, correlate data, determine whether an incident occurred, assess its severity and document findings. Prioritization considers functional impact, information impact and recoverability. SANS calls this phase identification.

Example

Confirming that an EDR alert reflects real credential dumping and identifying affected hosts.

Exam tip

Prioritizing incidents by business impact happens in detection and analysis.

Related terms