1 Endpoint, SIEM & Network Detection
Modern organisations generate enormous telemetry volumes, and detection signal comes from everywhere at once.
2 Identity, Cloud & SaaS Detection
Modern attacks increasingly target identities rather than individual computers. Important identity telemetry spans Entra ID, Active Directory, Okta, Google Workspace authentication, VPN authentication, PAM platforms, MFA systems, RADIUS, LDAP, Kerberos and SSO platforms (Module 9 and Module 10 in full). Watch for impossible travel, MFA fatigue, unexpected MFA registration, password resets, new authentication methods, privilege escalation, new admin accounts, service-account activity, and suspicious OAuth consent.
Cloud incidents need cloud-specific telemetry — AWS CloudTrail, GuardDuty, VPC Flow Logs, S3 access logs, IAM events; Azure Activity Logs, Entra sign-in logs, Defender for Cloud; GCP Cloud Audit Logs, Security Command Center. Crucially, cloud incidents may leave no traditional endpoint evidence at all — an attacker can compromise an API key and steal data directly from cloud storage without installing malware anywhere.
SaaS incidents happen entirely inside platforms like Microsoft 365, Google Workspace, Salesforce, ServiceNow, GitHub, Slack, Dropbox and Workday. A compromised SaaS administrator can expose enormous amounts of data, which is why responders need access to SaaS audit logs specifically, not just endpoint and network telemetry.
3 Legacy Detection Technologies
Global companies rarely run only modern technology. You may encounter Windows Server 2008/2012, Windows 7, legacy UNIX, Solaris, AIX, mainframes, IBM i/AS400, older Oracle environments, legacy Java applications, physical firewall appliances, industrial control systems, SCADA, and older antivirus. These environments often can't run modern EDR, so responders instead rely on Windows Event Logs, Syslog, application logs, firewall logs, NetFlow, packet captures, file timestamps, authentication logs, database audit logs, and manual forensic collection. A good incident responder needs to be fluent in both ends of that spectrum — not just the newest platform.
4 Investigation: The Core Questions
Detection tells you something suspicious may have happened. Investigation answers what actually happened, by establishing:
5 Timeline & the Attack Chain
One of the first objectives is a timeline:
02:13 User receives phishing email
02:17 User opens malicious attachment
02:18 Suspicious PowerShell process starts
02:19 Malware contacts external server
02:24 Credentials dumped from workstation
02:31 Attacker authenticates to file server
02:47 Domain administrator account accessed
03:15 Backup system accessed
03:42 Large outbound data transfer begins
04:26 Ransomware deployed
04:31 Hundreds of servers begin encrypting
04:34 SOC receives ransomware alerts
04:37 Incident declared SEV1Stop thinking of incidents as one action — a ransomware attack is typically a whole chain: Initial Access → Execution → Persistence → Privilege Escalation → Credential Access → Discovery → Lateral Movement → Data Collection → Data Exfiltration → Backup Destruction → Ransomware Deployment. MITRE ATT&CK terminology (Module 11, Lesson 2) gives you a shared vocabulary for labelling each stage as you build the timeline.
6 Scoping the Incident
One of the hardest IR questions: how large is the compromise? Suppose malware turns up on one laptop — don't assume 1 infected laptop = entire incident. It may just be the first visible symptom.
🔮 Think it through
You've found malware on one workstation. List at least five questions you'd need answered before you could confidently say the incident is contained to that one machine.
Reveal a working list
Which account was logged in, and was it privileged? Which systems did that account access? Were credentials stolen, and were other accounts compromised as a result? Which IPs communicated with the device? Did malware execute anywhere else? Did lateral movement occur? Were Domain Controllers, cloud infrastructure, or backups accessed? Was data exfiltrated? Was persistence created? Scoping is not a one-time step — it continues throughout the incident as new evidence changes the answer.
7 Indicators of Compromise vs Indicators of Attack
IOCs (Indicators of Compromise) are static artefacts — IP addresses, domains, URLs, file hashes, filenames, registry entries, scheduled tasks, user accounts, processes, services, certificates, email addresses, OAuth applications, cloud API activity. If malware communicates with 203.0.113.45, the SOC can search all firewall, proxy and EDR logs for anything else talking to that same address — this is threat hunting (Module 11, Lesson 6) applied to a live incident.
IOAs (Indicators of Attack) focus on behaviour instead, because a malicious IP can change in minutes while behaviour is much stickier: an Office app spawning PowerShell, PowerShell downloading executable content, a service account performing an interactive login, a Domain Admin authenticating to hundreds of systems, unexpected scheduled-task creation, a large number of files being renamed rapidly, backup deletion, mass shadow-copy deletion, or security tooling being unexpectedly disabled. Modern teams increasingly weight IOAs over IOCs for exactly this reason.
8 Evidence Preservation & Chain of Custody
Investigators must avoid destroying evidence unnecessarily. Important evidence includes RAM, disk images, endpoint telemetry, Windows Event Logs, cloud audit logs, firewall logs, authentication logs, email headers, malicious files, network captures, application/database logs, screenshots, and ransom notes. Some of it is volatile — RAM disappears the moment a machine powers off, and short-retention logs can vanish within hours or days. CISA's ransomware guidance specifically recommends preserving relevant evidence, including memory captures, disk images, logs and indicators, when practical during response.
For serious incidents, evidence may eventually be used in legal proceedings, insurance claims, regulatory investigations, or criminal investigations. That means keeping a chain of custody: who collected the evidence, when, from where, how, where it was stored, who accessed it, and whether hashes were calculated to prove it wasn't tampered with afterward.
Lesson Outcome
You should now be able to name detection sources across endpoint, SIEM, network, identity, cloud, SaaS and legacy environments, build an incident timeline and map it to attack-chain stages, explain why scoping continues throughout an incident rather than happening once, distinguish IOCs from IOAs, and explain why evidence preservation and chain of custody matter even before you know whether legal action will follow. Lesson 2 covers what you actually do with everything you've found — containment, eradication and recovery.