Please enable JavaScript.
Coggle requires JavaScript to display documents.
2 SANS Incident Response Framework Very popular in SOC environments. -…
2 SANS Incident Response Framework
Very popular in SOC environments.
🛡️ SANS Incident Response Framework
🏢 Enterprise Linux SOC Incident Response Lifecycle
1️⃣ Preparation Phase
🎯 Objective
Build capability before security incidents occur
Reduce response time
Improve detection and recovery
🏗️ Enterprise Preparation Activities
🖥️ Linux Infrastructure Readiness
Linux server inventory
Hostname
IP address
Operating system version
Installed applications
Owner information
Asset classification
Critical servers
Database servers
Web servers
Authentication servers
Production systems
🔐 Security Configuration
Enable secure authentication
SSH hardening
MFA implementation
Disable root SSH login
User and privilege management
sudo configuration
Least privilege access
Role-based access control
Firewall configuration
firewalld
iptables
nftables
📊 Logging and Monitoring
Linux Logs
/var/log/auth.log
/var/log/secure
/var/log/syslog
/var/log/messages
Centralized Logging
Separate log server
Prevent attacker log modification
Log retention policy
Tools
SIEM
Elastic SIEM
Splunk
QRadar
Log collectors
Filebeat
Fluent Bit
Syslog-ng
🛠️ Incident Response Tools Preparation
Forensics Tools
Autopsy
Sleuth Kit
Volatility
Malware Analysis
YARA
ClamAV
System Investigation
lsof
ps
netstat
ss
strace
Integrity Monitoring
AIDE
OSSEC
Wazuh
2️⃣ Identification Phase
🎯 Objective
Detect and confirm security incidents
🚨 Alert Sources
SIEM Alerts
Failed SSH login
Malware detection
Privilege escalation
Suspicious process
Security Tools
IDS/IPS
EDR
Vulnerability Scanner
User Reports
Account compromise
System slowdown
Unauthorized changes
🔍 Incident Validation
Confirm Alert
False positive check
Event correlation
Log verification
Determine Incident Type
🔑 Credential Attack
SSH brute force
Password spraying
Stolen credentials
🦠 Malware Infection
Unknown processes
Suspicious files
Rootkit detection
👤 Privilege Escalation
Unauthorized sudo access
SUID abuse
Kernel exploitation
📥 Evidence Collection
System Information
Host details
hostname
uptime
kernel version
Users
cat /etc/passwd
last
who
w
Process Investigation
Running processes
ps aux
Open files
lsof
Network connections
ss -tulpn
netstat -antp
3️⃣ Containment Phase
🎯 Objective
Stop attacker activity and limit damage
🚧 Short-Term Containment
Network Isolation
Block attacker IP
firewall rules
security groups
Disconnect compromised host
Account Control
Disable compromised user
usermod -L username
Reset passwords
Revoke sessions
🔒 Long-Term Containment
Security Hardening
Patch vulnerabilities
Update passwords
Enable MFA
Improve firewall rules
📌 Evidence Preservation
Create forensic copy
Preserve logs
Capture memory
RAM acquisition
Document timeline
4️⃣ Eradication Phase
🎯 Objective
Remove attacker presence completely
🔎 Root Cause Analysis
Identify entry point
Vulnerability exploited
Weak password
Phishing
Misconfiguration
🧹 Remove Threat
Malware Removal
Delete malicious files
Remove backdoors
Kill malicious processes
Persistence Removal
Check cron jobs
crontab -l
Check startup services
systemctl list-unit-files
Check SSH keys
~/.ssh/authorized_keys
Check users
/etc/passwd
🔐 System Hardening
Update packages
apt update
apt upgrade
Fix permissions
chmod
chown
Security policies
SELinux
AppArmor
5️⃣ Recovery Phase
🎯 Objective
Restore normal business operation safely
🔄 System Restoration
Restore from backup
Rebuild compromised servers
Validate system integrity
🧪 Security Validation
Vulnerability scanning
Nessus
OpenVAS
Qualys
Configuration Review
CIS Benchmark
NIST Controls
📈 Monitoring After Recovery
Increased logging
SIEM monitoring
Watch suspicious activity
User activity monitoring
6️⃣ Lessons Learned Phase
🎯 Objective
Improve future incident response
📋 Incident Report
Executive Summary
Timeline
Impact Assessment
Root Cause
Actions Taken
🔍 Technical Review
What happened?
How attacker entered?
Which controls failed?
What evidence was collected?
🛠️ Improvement Actions
Update security policies
Improve monitoring rules
Add detection signatures
Patch vulnerabilities
📚 Knowledge Sharing
SOC training
Playbook updates
Security awareness training
🖥️ Enterprise Linux SSH Brute Force Example
🚨 Detection
SIEM Alert
Multiple failed SSH logins
Same source IP
Multiple usernames
1️⃣ Identification
Collect Evidence
Authentication Logs
Ubuntu
/var/log/auth.log
RHEL
/var/log/secure
Commands
last
lastb
journalctl -u ssh
grep "Failed password" /var/log/auth.log
2️⃣ Containment
Block Attacker
Firewall
ufw deny attacker_IP
firewall-cmd --add-rich-rule
Disable Account
passwd -l username
Terminate Sessions
pkill -u username
3️⃣ Eradication
Remove Persistence
Check SSH keys
~/.ssh/authorized_keys
Check Users
/etc/passwd
Check Cron
crontab -l
Patch System
apt update
apt upgrade
4️⃣ Recovery
Restore Service
Restart SSH
systemctl restart ssh
Monitor
SIEM dashboard
Authentication logs
5️⃣ Lessons Learned
Improve Controls
Enable MFA
Disable password login
Use SSH keys
Implement fail2ban
Update SOC playbook
🏢 Enterprise SOC Integration
👨💻 SOC Analyst Level 1
Alert Monitoring
Initial Investigation
Evidence Collection
👨💻 SOC Analyst Level 2
Threat Hunting
Root Cause Analysis
Containment
👨💻 Incident Responder
Digital Forensics
Malware Analysis
Recovery Planning
👨💼 Security Manager
Risk Assessment
Compliance Reporting
Lessons Learned
📚 Framework Mapping
SANS IR Framework
Preparation
NIST Preparation
Identification
NIST Detection & Analysis
Containment
NIST Containment
Eradication
NIST Eradication
Recovery
NIST Recovery
Lessons Learned
NIST Post-Incident Activity
🎯 Enterprise Goal
Detect Faster
Contain Quickly
Remove Threat Completely
Restore Secure Operations
Prevent Repeat Incidents
🛡️ SANS Incident Response Framework
📌 Full Name
SANS Incident Response Process
🏢 Organization
SANS Institute
🎯 Main Purpose
Provide practical steps for incident responders
Guide security teams during real attacks
Provide a structured response workflow
Help reduce incident impact
⚙️ Usage
SOC Operations
Daily Security Response
Incident Investigation
Threat Detection
Malware Investigation
Security Incident Handling
👥 Audience
SOC Analysts
Incident Responders
Security Engineers
Threat Hunters
Digital Forensics Analysts
📝 Style
Hands-on
Operational Workflow
Practical Approach
Step-by-Step Process
Action-Oriented
🔍 Focus
Fast Investigation
Quick Detection
Incident Analysis
Containment
Eradication
Recovery
Lessons Learned