# Incident Triage Strategy

## Phase 1: Initial Assessment (budget: 15%, target: 0-15 min)
1. What triggered the alert/report? (SIEM alert, user report, automated detection)
2. Initial scope: affected systems, users, timeframe
3. Severity classification: is this data loss? Ransomware? Unauthorized access? False positive?
4. Determine: is this an active incident or historical finding?

**Decision point:** Active incident → skip to containment. Historical → continue analysis.

## Phase 2: Scope Determination (budget: 20%)
1. Identify all affected systems: check lateral movement indicators
2. Timeline: when did it start? What was the initial access vector?
3. Check: data exfiltration indicators (unusual outbound traffic, large transfers)
4. Check: persistence mechanisms (scheduled tasks, startup items, new accounts)

## Phase 3: Containment (budget: 20%)
1. **Network isolation:** block C2 IPs/domains at firewall, isolate affected hosts
2. **Account lockout:** disable compromised accounts, rotate credentials
3. **Evidence preservation:** snapshot affected systems BEFORE changes
4. **Communication:** notify stakeholders per IR plan

**Critical:** Preserve evidence BEFORE eradication. Memory dumps, disk images, log exports.

## Phase 4: Investigation (budget: 30%)
1. Root cause analysis: how did the attacker get in?
2. Full timeline reconstruction: initial access → escalation → lateral → objectives
3. IOC extraction: IPs, domains, hashes, filenames, user agents, tools used
4. Check threat intel: are these IOCs associated with known threat actors?
5. Determine: what data was accessed/exfiltrated?

## Phase 5: Eradication & Recovery (budget: 15%)
1. Remove attacker presence: malware, backdoors, persistence mechanisms
2. Patch entry vector
3. Restore from known-good backups if needed
4. Verify: clean bill of health scan
5. Monitor: enhanced monitoring for 30 days post-incident

## Post-Incident
1. After-action report: timeline, root cause, impact, lessons learned
2. Detection gap analysis: what should have caught this earlier?
3. Write new detection rules based on observed TTPs
4. Update IR runbook with lessons learned

## Escalation Triggers
- Ransomware detected → immediate executive notification, legal, potentially FBI/CISA
- Data exfiltration confirmed → legal, privacy officer, notification requirements (GDPR 72hr)
- Nation-state indicators → executive, legal, potentially government agencies
- Active ongoing attack → all hands, consider third-party IR support
