Incident Response

Incident response skill for the full lifecycle from initial triage through forensic collection, severity declaration, and escalation routing. This is NOT threat hunting (see threat-detection) or post-incident compliance mapping (see governance/compliance-mapping) — this is about classifying, triaging, and managing declared security incidents.

Table of Contents

• Overview
• Incident Triage Tool
• Incident Classification
• Severity Framework
• False Positive Filtering
• Forensic Evidence Collection
• Escalation Paths
• Regulatory Notification Obligations
• Workflows
• Anti-Patterns
• Cross-References