Skip to content
sec/atlas
knowledge base · incident response & forensics

Incident response, from alert to evidence.

How to prepare for, detect, contain and investigate an intrusion: the lifecycle, threat hunting and intelligence, ransomware, forensics and malware triage.

$ click a card for details · ctrl+k to search

learning map

Topics are laid out by level, from foundations to advanced. Arrows point from a prerequisite to what builds on it. Select a topic to preview it, or follow the highlighted next step.

Your next step

0 of 8 studied
start this topic

01 Foundations

The ideas everything else builds on.

02 Practitioner

Apply the controls and make them work in practice.

03 Advanced

Design, scale and operate at depth.

  • studied
  • ready to study
  • prerequisites missing

from preparation to evidence

Prepare, detect, respond, investigate: each phase feeds the next and the last one improves the first. Each chip opens the matching topic.

  1. 01prepare

    decide before the crisis

    roles, severity and communicationwho attacks us and howtabletop exercises

    gate: the first hour of an incident is a rehearsed procedure, not an improvisation

  2. 02detect

    find what alerts missed

    hypothesis-driven searchclean timestamps and pivotshunts become detections

    gate: every confirmed technique leaves behind an automated detection

  3. 03respond

    stop the harm, keep the evidence

    scope first, then containthe ransomware playbookrecover from known-good

    gate: containment is proportional, coordinated and recorded

  4. 04investigate

    understand exactly what happened

    evidence, order of volatility, custodysafe triage of a suspicious fileblameless post-incident review

    gate: the report explains how they got in, what they did and what changes

topics

The incident response lifecycle
An incident is not the moment to invent a process. Teams that respond well decided roles, severity levels and communication channels long before something broke.
concept· stage: prepare
Threat intelligence
A list of bad IP addresses is data. Intelligence is knowing which adversaries target you, what they do, and what that means for your priorities, with a confidence level attached.
concept· stage: prepare
Threat hunting
Detection waits for a rule to fire. Hunting assumes something may already be inside and searches for the evidence, then turns what it finds into permanent detections.
practice· stage: detect
Log analysis and building a timeline
Every investigation ends as a timeline: first access, what they touched, how they moved, what they took. The quality of that timeline depends on clean timestamps and good pivots.
technique· stage: detect
Triage, scoping and containment
The first hour is about two questions: how far has this gone, and what is the least damaging way to stop it? Answer them in the right order and keep the evidence intact.
practice· stage: respond
Ransomware response playbook
Ransomware is a business crisis with a technical core. The teams that recover well had working backups, practiced the playbook and made the hard decisions before the pressure.
practice· stage: respond
Digital forensics fundamentals
Forensics is the discipline of evidence: collect it so it cannot be disputed, analyze copies instead of originals, and document every step so another examiner reaches the same result.
technique· stage: investigate
Malware analysis fundamentals
The goal is not to admire the malware but to answer practical questions: what does it do, how does it persist, how does it talk to its operator, and how do we detect and remove it?
technique· stage: investigate