A post-incident review (or "lessons learned") occurs after an incident has been resolved. It is designed to analyze what happened, why it happened, and how similar incidents can be prevented in the future. Eradicating malware and updating firewall rules happen during the incident, and monitoring ongoing attacks is part of incident detection.
A SIEM system aggregates and analyzes logs from different sources such as firewalls, IDS/IPS, and operating systems to detect potential security threats and anomalous behavior. It helps with real-time monitoring, incident detection, and response. SIEMs do not encrypt data, manage traffic, or perform vulnerability scans.
The containment phase focuses on isolating affected systems to prevent further damage. Disconnecting the system from the network limits the attacker's ability to spread or cause more harm. Analyzing logs is part of the identification phase, reporting is part of communication, and restoring systems occurs during recovery.
Continuous security monitoring involves the ongoing process of analyzing security threats to detect malicious activity in real-time. The goal is to proactively detect threats, enabling rapid investigation and response. Updating software, ensuring compliance, and backing up data are important, but they are not the main purpose of continuous monitoring.
The Identification phase is the first step in the incident response process, where security engineers detect and verify that a security incident has occurred. Once identified, other phases such as containment, eradication, and recovery follow.
