Incident Handling

Comprehensive incident response procedures, case management, and escalation workflows for the SOC

Incident Handling

This guide outlines the complete incident response lifecycle for the Enterprise SOC, from initial detection through post-incident review. It covers the use of TheHive for case management, escalation procedures, and best practices for effective incident response.

Incident Response Workflow

1. Detection and Identification

   Identify potential security incidents through:

   • Automated alerts from Wazuh, Snort, Suricata
   • Threat hunting activities
   • User reports
   • Third-party notifications

   Key Actions:

   • Acknowledge the alert in monitoring system
   • Perform initial triage to confirm it’s a genuine incident
   • Gather preliminary information (affected systems, timeline, indicators)
2. Incident Classification

   Classify the incident by:

   • Type: Malware, unauthorized access, data breach, DDoS, insider threat, etc.
   • Severity: Critical, High, Medium, Low
   • Scope: Single endpoint, multiple systems, network-wide
   • Impact: Confidentiality, integrity, availability

   Create TheHive Case:

   • Open new case with descriptive title
   • Set appropriate severity and TLP
   • Assign to appropriate analyst
   • Add initial observables (IPs, domains, hashes)
3. Containment

   Implement containment measures to prevent spread:

   Short-term Containment:

   • Isolate affected systems from network
   • Block malicious IPs/domains at firewall
   • Disable compromised user accounts
   • Implement emergency firewall rules

   Long-term Containment:

   • Apply temporary patches or workarounds
   • Segment network to limit lateral movement
   • Enhanced monitoring of related systems
   • Prepare for eradication phase
4. Investigation and Analysis

   Conduct thorough investigation:

   • Collect forensic evidence from affected systems
   • Analyze logs in Elasticsearch for full attack timeline
   • Review Wazuh EDR data for endpoint artifacts
   • Examine IDS/IPS logs for network indicators
   • Identify root cause and attack vector
   • Determine full scope of compromise
   • Document all findings in TheHive

   Use Cortex Analyzers:

   • Analyze file hashes with VirusTotal
   • Check IP reputation with AbuseIPDB
   • Investigate domains with passive DNS
   • Extract IOCs automatically
5. Eradication

   Remove threat from environment:

   • Remove malware from infected systems
   • Delete unauthorized accounts or access
   • Close exploited vulnerabilities
   • Update security controls (IDS rules, firewall policies)
   • Verify complete removal of threat

   Verify Eradication:

   • Scan systems with updated antivirus
   • Search logs for indicators of persistence
   • Monitor for reinfection attempts
6. Recovery

   Restore normal operations:

   • Restore systems from clean backups if necessary
   • Rebuild compromised systems from known-good images
   • Reset credentials for affected accounts
   • Gradually restore services with enhanced monitoring
   • Verify business operations are normal
   • Continue monitoring for 72+ hours post-recovery
7. Post-Incident Review

   Conduct lessons learned session:

   • Document complete incident timeline
   • Analyze response effectiveness
   • Identify improvements for detection and response
   • Update playbooks and procedures
   • Share findings with stakeholders
   • Implement preventive measures
   • Close TheHive case with final report

Using TheHive for Case Management

Creating a New Case

1. Access TheHive

   Navigate to TheHive web interface and authenticate

2. Create New Case

   Click “New Case” and fill in required fields:

   • Title: Descriptive incident name (e.g., “Malware Detection on HR-WKS-042”)
   • Severity: Critical/High/Medium/Low
   • TLP: Traffic Light Protocol classification (Red/Amber/Green/White)
   • PAP: Permissible Actions Protocol
   • Description: Detailed incident summary
   • Tags: Categorization tags (malware, phishing, data-breach, etc.)
3. Add Observables

   Add indicators of compromise:

   • IP addresses (source and destination)
   • Domain names
   • File hashes (MD5, SHA1, SHA256)
   • Email addresses
   • URLs
   • Filenames
   • Registry keys
   • User accounts

   Mark observables as IOCs for threat intelligence sharing

4. Create Tasks

   Break down response into tasks:

   • Initial triage
   • Forensic collection
   • Malware analysis
   • Containment actions
   • Communication with stakeholders
   • Documentation

   Assign tasks to team members with due dates

TheHive integrates automatically with Wazuh for high-severity alerts. Configure alert thresholds to auto-create cases for critical events.

Using Cortex for Analysis

Cortex provides automated analysis and response capabilities:

Threat Intelligence

Query multiple threat intel sources (VirusTotal, AbuseIPDB, OTX) for observable reputation

File Analysis

Analyze suspicious files with sandboxes and static analysis tools

Domain Investigation

Perform WHOIS, passive DNS, and reputation checks on domains

Response Actions

Execute automated containment through responders (block IP, quarantine endpoint)

Running Analyzers:

1. Select an observable in TheHive case
2. Click “Run Analyzers”
3. Choose relevant analyzers (e.g., VirusTotal for hash, MaxMind for IP)
4. Review analyzer reports when complete
5. Use results to inform investigation decisions

Common Analyzers:

• VirusTotal_GetReport: Check file/URL/domain/IP reputation
• AbuseIPDB: IP address abuse history
• Shodan: Internet exposure analysis
• MaxMind: IP geolocation
• MISP: Query MISP threat intelligence platform

Case Documentation Best Practices

Thorough documentation is critical for legal, compliance, and learning purposes. Document as you investigate, not after.

What to Document:

1. Timeline: Precise timestamps for all events and actions
2. Evidence: Screenshots, log excerpts, forensic artifacts
3. Analysis: Your thought process and investigative steps
4. Actions Taken: Every containment, eradication, and recovery action
5. Communications: Stakeholder notifications and approvals
6. Outcomes: Resolution status and lessons learned

Documentation Template:

## Incident Summary
- Date/Time Detected: [timestamp]
- Detected By: [alert/analyst/user report]
- Affected Systems: [list]
- Incident Type: [malware/breach/etc]
- Current Status: [contained/investigating/resolved]

## Timeline
- [timestamp]: Initial detection via [source]
- [timestamp]: Case created, assigned to [analyst]
- [timestamp]: Containment action - [description]
- [timestamp]: [additional events]

## Technical Analysis
[Detailed findings, IOCs, attack chain]

## Response Actions
[List of all actions taken]

## Impact Assessment
[Business impact, data affected, downtime]

## Recommendations
[Preventive measures, improvements]

Incident Severity Classification

Critical Severity

Criteria:

• Active data exfiltration in progress
• Ransomware encryption of critical systems
• Complete compromise of domain controller or core infrastructure
• Confirmed APT or nation-state activity
• Public-facing breach with customer data exposure

Response SLA: Immediate (within 15 minutes)

Escalation: Notify SOC Manager, CISO, and executive leadership immediately

Resources: Full team mobilization, consider external incident response support

High Severity

Criteria:

• Malware detected on multiple systems
• Successful exploitation of critical vulnerability
• Unauthorized access to sensitive data
• Privilege escalation to administrative level
• Confirmed command and control communication

Response SLA: Within 30 minutes

Escalation: Notify SOC Manager and relevant system owners

Resources: Senior analyst assignment, potential Tier 2/3 involvement

Medium Severity

Criteria:

• Malware detected on isolated endpoint
• Suspicious activity requiring investigation
• Policy violations with security implications
• Failed exploitation attempts
• Anomalous network traffic

Response SLA: Within 2 hours

Escalation: SOC Team Lead notification

Resources: Standard analyst response

Low Severity

Criteria:

• Minor policy violations
• Informational security events
• False positive confirmation
• Routine security operations

Response SLA: Within 8 hours or next business day

Escalation: Document in ticketing system

Resources: Standard triage and documentation

Escalation Procedures

When to Escalate

1. Tier 1 to Tier 2 Escalation

   Escalate when:

   • Incident complexity exceeds Tier 1 capabilities
   • Deep forensic analysis required
   • Advanced malware analysis needed
   • Incident duration exceeds 4 hours without resolution
   • Multiple systems affected

   Process:

   1. Document all findings in TheHive
   2. Assign case to Tier 2 queue
   3. Provide verbal briefing to Tier 2 analyst
   4. Remain available for questions
2. Tier 2 to Tier 3 / Management Escalation

   Escalate when:

   • Critical infrastructure compromised
   • Data breach confirmed or suspected
   • Legal or regulatory implications
   • External support needed (vendors, law enforcement)
   • Incident declared as “major incident”

   Process:

   1. Update TheHive case with severity increase
   2. Notify SOC Manager via phone/SMS
   3. Prepare executive summary
   4. Join incident bridge call if activated
3. External Escalation

   Escalate externally when:

   • Law enforcement involvement required
   • Regulatory reporting obligations (GDPR, HIPAA, etc.)
   • Customer notification needed
   • Vendor/partner notification required
   • Cyber insurance claim activation

   Process:

   1. Obtain management approval
   2. Follow legal/compliance notification procedures
   3. Coordinate with public relations if media involved
   4. Document all external communications

Never delay escalation to avoid appearing incapable. Early escalation of serious incidents is professional and expected.

Escalation Contact Matrix

Severity	Initial Contact	Timeframe	Additional Notifications
Critical	SOC Manager + CISO	Immediate	Executive team, Legal, PR
High	SOC Manager	Within 30 min	System owners, IT Management
Medium	SOC Team Lead	Within 2 hours	Affected department heads
Low	Document in system	Next business day	None required

Incident Response Playbooks

Malware Incident

1. Immediate Actions

   1. Isolate infected system from network (disconnect network cable or disable in firewall)
   2. Create TheHive case with malware sample hash
   3. Run Cortex analyzers on file hash (VirusTotal, reverse.it)
   4. Identify other systems with same IOCs using Wazuh/Elasticsearch
2. Containment

   1. Block C2 domains/IPs at firewall and DNS
   2. Update IDS/IPS signatures for detection
   3. Push Wazuh rule to detect malware across all endpoints
   4. Search for related IOCs (file paths, registry keys, network connections)
3. Eradication

   1. Run full antivirus scan with updated signatures
   2. Remove malware files and persistence mechanisms
   3. Reset credentials for accounts used on infected system
   4. Apply missing patches that may have been exploited
4. Recovery

   1. Verify malware removal with clean scan
   2. Monitor system for 24-48 hours before returning to production
   3. Restore from backup if system heavily compromised
   4. Update Wazuh FIM rules to detect similar intrusions

Phishing Incident

1. Initial Response

   1. Obtain copy of phishing email (forward as attachment to preserve headers)
   2. Create TheHive case with email observables (sender, URLs, attachments)
   3. Check if users clicked links or opened attachments
   4. Search email logs for other recipients
2. Containment

   1. Block sender address and domain at email gateway
   2. Delete phishing emails from all mailboxes
   3. Block malicious URLs in web proxy/firewall
   4. Reset credentials for users who entered passwords
3. Investigation

   1. Analyze email headers for origin
   2. Analyze attachments in sandbox (use Cortex analyzers)
   3. Check compromised URLs with URLscan.io
   4. Review logs for credential use post-phishing
   5. Check for data exfiltration or account compromise
4. User Education

   1. Notify affected users of phishing attempt
   2. Provide security awareness guidance
   3. Report trends to security awareness team
   4. Consider targeted training for repeat clickers

Data Breach Incident

Data breach incidents have significant legal and regulatory implications. Involve legal counsel early in the process.

1. Immediate Containment

   1. Identify and stop ongoing exfiltration
   2. Isolate compromised systems
   3. Preserve evidence (memory dumps, disk images, logs)
   4. Create TheHive case with “data-breach” tag
   5. Notify management immediately
2. Scope Assessment

   1. Identify what data was accessed/exfiltrated
   2. Determine number of records affected
   3. Classify data sensitivity (PII, PHI, financial, trade secrets)
   4. Establish timeline of unauthorized access
   5. Identify affected individuals/customers
3. Legal and Regulatory

   1. Engage legal counsel
   2. Assess regulatory notification requirements
   3. Prepare notification templates (customers, regulators, media)
   4. Activate cyber insurance if applicable
   5. Consider law enforcement notification
4. Notification and Remediation

   1. Notify affected individuals per legal requirements
   2. Offer credit monitoring if appropriate
   3. Implement additional security controls
   4. Conduct security assessment of similar systems
   5. Update incident response plan based on lessons learned

Post-Incident Review Process

Post-incident reviews are learning opportunities, not blame sessions. Focus on process improvement, not individual mistakes.

Review Meeting Agenda

1. Incident Overview (10 minutes)

   • Present incident timeline
   • Describe attack vector and techniques
   • Summarize impact and scope
   • Review response timeline
2. What Went Well (15 minutes)

   • Effective detection mechanisms
   • Successful containment actions
   • Good communication and collaboration
   • Useful tools and processes
3. What Went Wrong (20 minutes)

   • Delayed detection or response
   • Missing visibility or monitoring
   • Tool or process failures
   • Communication breakdowns
   • Documentation gaps
4. Action Items (15 minutes)

   • Detection improvements needed
   • Additional monitoring or alerting
   • Playbook updates
   • Training requirements
   • Technology investments

   Assign owners and due dates for each action item

Review Documentation

Create a formal post-incident report including:

1. Executive Summary: High-level overview for management
2. Detailed Timeline: Complete event sequence
3. Technical Analysis: Attack methods, tools, and IOCs
4. Impact Assessment: Business impact, costs, data affected
5. Response Evaluation: What worked and what didn’t
6. Recommendations: Specific improvements with priorities
7. Action Plan: Assigned tasks with deadlines

Share sanitized incident reports with the broader security community to help others defend against similar attacks.

Communication During Incidents

Internal Communications

SOC Team:

• Use dedicated Slack/Teams channel for real-time coordination
• Update TheHive case frequently with progress
• Hold standup calls every 2-4 hours for major incidents

Management:

• Provide initial notification within 30 minutes of critical incident
• Send status updates every 2 hours or when major developments occur
• Keep updates concise: status, impact, next steps, ETA

Affected Users:

• Notify of service disruptions promptly
• Provide clear guidance on required actions
• Set expectations for resolution timeframe

External Communications

All external communications during a security incident must be approved by management and legal counsel.

Guidelines:

• Coordinate with PR/communications team
• Stick to approved messaging
• Never speculate or provide unconfirmed information
• Refer media inquiries to designated spokesperson
• Document all external communications

Metrics and Reporting

Track key incident response metrics:

• Mean Time to Detect (MTTD): Time from incident occurrence to detection
• Mean Time to Respond (MTTR): Time from detection to containment
• Mean Time to Resolve (MTTR): Time from detection to full resolution
• Incident Count by Type: Trends in incident categories
• Incident Count by Severity: Distribution of severity levels
• False Positive Rate: Alerts that were not incidents
• Escalation Rate: Percentage requiring escalation

Regular metric review helps identify areas for improvement in detection and response capabilities.

Related Resources

• Monitoring Guide - Daily monitoring operations and alert management
• Threat Hunting - Proactive threat detection techniques
• Maintenance - System maintenance and tuning procedures