Investigating an Incident

In the previous chapter, you learned about the importance of using threat intelligence to help the Blue Team enhance the organization’s defense and also to know their adversaries better. In this chapter, you will learn how to put all these tools together to perform an investigation. Beyond the tools, you will also learn how to approach an incident, ask the right questions, and narrow down the scope. To illustrate that, there will be two scenarios, where one is in an on-premises organization and the other one is in a hybrid environment. Each scenario will have its unique characteristics and challenges.

In this chapter, we are going over the following topics:

• Scoping the issue
• On-premises compromised system
• Cloud-based compromised system
• Proactive investigation
• Conclusion and lessons learned

Let’s start by examining how to determine if an issue has occurred, and what artifacts can provide more information...