Security Operations

Level 1: Quick Reference

Incident Response Lifecycle (NIST 800-61 Rev 2)

1. PREPARATION       - Policies, tools, training, communication plans
2. DETECTION         - SIEM alerts, log analysis, threat intelligence
3. CONTAINMENT       - Isolate, remove threat, restore operations
4. POST-INCIDENT     - Lessons learned, documentation, improvement

SOC Tiers