R. Response (scope)
STARTS WHENVerified incident with at least one indicator.
DONE WHENSystems, accounts, and data enumerated, with visibility gaps named.
Scope establishes the breadth of the incident, the systems involved, and the potential impact on the organization. It starts from what identification and verification produced, works out the attacker's TTPs, derives indicators from them, and uses those indicators to find every system in scope.
Do it before cleaning anything. Cleaning only the systems you already know about leaves the attacker the rest, which is how the same incident gets declared twice in a quarter.
Scope owns the attack timeline. Eradication annotates it, the debrief finalizes it, nobody else redraws it.
| Phase | Targets | Sources |
|---|---|---|
| Critical assets first | Domain controllers, file servers, databases, anything holding sensitive data, regardless of where the first indicator appeared | SIEM, EDR, authenticated scans |
| Lateral expansion | Same segment, systems authenticated to by compromised accounts, systems sharing administrative credentials | Authentication logs, EDR, network flow |
| Environmental sweep | Everything remaining. Days or weeks at scale. | EDR, inventory tools, scripted checks, compromise assessment tooling |
| # | Item |
|---|---|
| 1 | Every indicator from detection and verification listed and searchable |
| 2 | Enterprise-wide hunt run across SIEM, EDR, and any threat hunting platform |
| 3 | Progressive sweep worked in order: critical assets, lateral, environmental |
| 4 | Initial compromise and patient zero identified |
| 5 | Lateral movement mapped through authentication logs and file access patterns |
| 6 | Persistence mechanism deployment dated |
| 7 | Time of access to or exfiltration of sensitive data established |
| 8 | Visibility gaps documented: unmanaged systems, thin logging, IoT, industrial devices |
| 9 | Network flow data used as the primary source for controllers and similar equipment with no central logging |
| 10 | Anti-forensics checked: log deletion, timestomping, obfuscation, living off the land |
| 11 | Cloud audit logs and container runtime security covered for cloud and hybrid estates |
Watch out
- In OT the visibility gap is the normal condition. Controllers do not log centrally, agents cannot be installed, and the maintenance window is next quarter. Plan on network flow as the primary evidence source, and write that into the response plan before it is needed.