Detection and verification – identifying, assessing, 
and confirming cybersecurity incidents targeting Windows systems

In this section, we will cover incident detection, followed by verification and classification, then moving to the analysis process.

Incident detection

Incident detection (identification) is a key step involving the initiation of the incident response process. By defining all possible sources of incident detection and SLAs, the cybersecurity team can achieve the best performance.

Over the course of years of incident response engagements, we have been able to define the following incident triggers:

• Security control alert: In this case, a notification format is predefined by a vendor and should include sufficient information about suspicious activity.
• Internal threat hunting: This refers to the proactive compromise assessment performed by the local cybersecurity team.
• Internal notification: This can be from the IT team, business...