Topics in this domain
- Event vs Incident vs Breach
- Developing the Incident Response Plan
- Incident Response Team Roles and Authority
- Incident Classification and Severity Levels
- Incident Response Playbooks and Decision Trees
- Escalation and Communication Plans
- Business Impact Analysis
- RTO, RPO, MTD and Recovery Prioritisation
- Business Continuity Planning and Strategies
- Crisis Management and Continuity Governance
- Disaster Recovery Planning
- Recovery Sites: Hot, Warm and Cold
- Backup Strategies and Cloud DR
- Incident Response Training
- Testing Plans: Tabletop, Functional and Full Interruption
- Evaluating Exercises and Improving Readiness
- Security Event Detection and Monitoring Methods
- SIEM, the SOC and Event Correlation
- Threat Intelligence and Indicators of Compromise
- Incident Triage and Initial Investigation
- Evidence Preservation, Forensics and Chain of Custody
- Containment Strategies: Short-Term and Long-Term
- Making Containment Decisions
- Breach Notification and Regulatory Reporting
- External Communications: Customers, Media and Law Enforcement
- Eradication, Recovery and Return to Normal Operations
- Post-Incident Review and Root Cause Analysis
- Lessons Learned and Incident Trend Analysis
Incident Triage and Initial Investigation
The first hour
When an alert or report arrives, the first decisions matter most. Triage decides quickly whether it’s real, how serious it is and who needs to act. The investigation that follows builds the facts that every later decision depends on. Incident investigation and evaluation is a named CISM topic, and one task is to investigate and document incidents in line with legal and regulatory requirements.
Triage
- Validate: a real incident or a false positive?
- Classify: category and initial severity.
- Scope: which systems, accounts and data? Is it still active?
- Prioritise against other incidents, by business impact.
- Assign and record: an owner, a ticket, a timeline started; escalate as the plan requires.
What the investigation must answer
| Question | Why it matters |
|---|---|
| How did they get in? | To close the entry point |
| When did it start? | Which backups are clean; notification timing |
| What did they access or take? | Breach notification and impact |
| Which systems and accounts? | The scope of containment and eradication |
| Are they still here? | How urgent containment is |
The scope often widens as facts emerge; reassess severity and escalate each time it does.
Investigate properly
- Record everything: a timeline of events, actions and decisions from the first minute. Undocumented actions can’t be defended later.
- Preserve evidence: capture images and logs before changing systems, where possible. Rebooting or wiping during triage can destroy it.
- Follow the law: privacy, employment law and legal privilege; involve legal early.
- Insider cases: stay discreet, involve HR and legal, and don’t tip off the suspect.
Example. An alert shows a privileged account copying payroll data at night. Instead of disabling the account immediately and alerting the user, the team quietly preserves logs, involves HR and legal, confirms it’s an insider, and then acts, with evidence that holds up at the disciplinary hearing.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| First step when an alert arrives | Validate it: real incident or false positive? |
| Most important record during an investigation | A timeline of events, actions and decisions |
| Before changing an affected system | Preserve evidence where possible |
| A suspected insider | Involve HR and legal; secure evidence discreetly |
| New facts widen the scope | Reassess severity and escalate |
In short
- Triage quickly validates, classifies, scopes and prioritises a suspected incident, then assigns and records it.
- Investigation establishes what happened, how, when, which assets and data were affected, and whether the attacker is still present.
- Investigating and documenting incidents in line with legal and regulatory requirements is a CISM task.
- Keep a timeline and record every action and decision from the start.
- Preserve evidence from the beginning in case of legal action, regulatory reporting or insurance claims.
- Scope widens as facts emerge; reassess severity and escalate as needed.
Exam traps
- Rebooting or wiping a system during triage can destroy evidence.
- Investigating only the first affected system misses the rest of the attack.
- Undocumented actions can't be defended later, to regulators or in court.
- Investigators shouldn't alert a suspected insider before evidence is secured and HR and legal are involved.
Slides
Click the slide and use the arrow keys. F toggles full screen.
Triage
1 / 8