Security Operations Center (SOC), SIEM & Incident Response (NIST SP 800-61)

Even with robust preventive defenses, security incidents are inevitable in modern hyper-connected enterprises. When an active breach occurs, an organization's survival depends on the speed and precision of its Security Operations Center (SOC) and Incident Response (IR) team.

In this comprehensive guide, we dissect the four phases of the NIST SP 800-61 Rev. 2 Incident Handling Lifecycle, analyze Security Information and Event Management (SIEM) telemetry correlation engines, evaluate detection metrics (MTTD and MTTR), and explore digital forensics principles.

The NIST SP 800-61 Incident Handling Lifecycle#

NIST Special Publication 800-61 Rev. 2 defines the four iterative phases of security incident handling:

+---------------------------------------------------------------+
|                      1. Preparation                           |
|       (Policies, Playbooks, Training, Telemetry Sensors)      |
+---------------------------------------------------------------+
                               |
                               v
+---------------------------------------------------------------+
|                  2. Detection & Analysis                      |
|       (SIEM Alerts, EDR Triage, Scope Identification)         |
+---------------------------------------------------------------+
                               |
                               v
+---------------------------------------------------------------+
|             3. Containment, Eradication & Recovery            |
|       (Network Isolation, Malware Removal, System Restore)    |
+---------------------------------------------------------------+
                               |
                               v
+---------------------------------------------------------------+
|                 4. Post-Incident Activity                     |
|       (Lessons Learned, Root Cause Analysis, IOC Updates)     |
+---------------------------------------------------------------+

Phase 1: Preparation#

The single most critical phase. An organization cannot respond to an emergency it has not planned for:

• Establishing a Computer Security Incident Response Team (CSIRT) with defined roles (Incident Commander, Lead Investigator, Legal Counsel, PR Officer).
• Deploying telemetry sensors: Endpoint Detection and Response (EDR), network taps, cloud trail logging.
• Developing and testing step-by-step incident playbooks (Ransomware, Compromised Credentials, DDoS).
• Securing out-of-band communication channels (Signal, external conference bridges) in case corporate email is compromised.

Phase 2: Detection and Analysis#

Identifying whether an anomalous alert represents a true positive incident and determining its blast radius:

• Correlating heterogeneous event logs across firewalls, authentication servers, and endpoints.
• Triage: Analyzing Indicators of Compromise (IOCs) such as file hashes, malicious IP addresses, and command-and-control (C2) domain lookups.
• Determining the attack timeline, entry vector, and affected assets.

Phase 3: Containment, Eradication, and Recovery#

• Short-Term Containment: Stopping the bleeding. Isolating affected endpoints from the network at the hypervisor or switch port level, revoking compromised API tokens, disabling breached user accounts.
• Long-Term Containment: Applying temporary defensive workarounds (blocking malicious IPs on perimeter firewalls, routing traffic through WAFs) while business operations continue.
• Eradication: Eliminating all malicious artifacts from the environment: removing persistence mechanisms (scheduled tasks, registry run keys, cron jobs), deleting malware binaries, and patching exploited vulnerabilities.
• Recovery: Restoring affected systems to clean, verified production status from trusted, immutable backups and monitoring closely for reinfection.

Phase 4: Post-Incident Activity (Lessons Learned)#

Within two weeks of incident closure, the CSIRT conducts a blameless post-mortem review:

• What exactly happened, and at what timestamps?
• How well did the documented playbooks perform?
• What detection blind spots allowed the adversary to dwell undetected?
• How must SIEM correlation rules, firewall policies, and employee training be updated?

Core Detection Metrics: MTTD and MTTR#

Executive leadership measures SOC operational efficiency using two industry-standard KPIs:

1. Mean Time to Detect (MTTD): The average duration between an adversary's initial infiltration into the environment and the moment security analysts detect and triage the intrusion. In high-performing SOCs, MTTD is measured in minutes; in poorly monitored environments, dwell time can exceed 200 days.
2. Mean Time to Remediate (MTTR): The average duration between incident detection and complete containment and eradication of the threat.

SIEM Architecture & Detection Engineering#

A Security Information and Event Management (SIEM) platform acts as the centralized central nervous system of a SOC:

Endpoints (Sysmon/EDR) ---+
Cloud (AWS CloudTrail) ---+---> [ SIEM Ingestion Engine ] ---> [ Correlation Rules ] ---> SOC Alert
Firewalls (Syslog) -------+

Writing Detection Rules in Sigma#

Security teams write vendor-agnostic detection rules using the Sigma standard:

title: Suspicious PowerShell Encoded Command Execution
status: production
description: Detects base64 encoded PowerShell execution indicative of malware stagers
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\powershell.exe'
        CommandLine|contains:
            - '-enc'
            - '-encodedcommand'
            - '-e '
    condition: selection
falsepositives:
    - Administrative maintenance scripts
level: high

Digital Forensics Principles: Chain of Custody#

When security incidents escalate to legal prosecution or insurance claims, digital forensics investigators must preserve the evidential integrity of artifacts:

• Order of Volatility: Collect the most volatile evidence first before powering down a machine:

1. CPU registers and L1/L2 caches.

2. Operating system RAM (physical memory capture via DumpIt or LiME).

3. Network state and routing tables.

4. Disk storage (bit-for-bit physical disk clones using dd with hardware write-blockers).

5. Optical media and backup tapes.

• Chain of Custody: A legally binding log documenting who obtained the evidence, the exact timestamp, where it was stored, and every individual who accessed or analyzed it. Cryptographic hash values (SHA-256) of forensic disk images are computed immediately upon capture and verified before and after analysis to prove evidence was never altered.

Checkpoint Questions & Practice Exercises#

Question 1: An investigator discovers an active malware infection on a critical server. Why should the investigator capture system RAM before pulling the power cord or rebooting the machine?

• Answer: Volatile memory (RAM) is lost immediately upon power loss. Modern advanced malware operates in-memory (fileless malware), injects code into legitimate processes, stores encryption keys in memory buffers, and maintains active socket connections. Capturing RAM preserves vital forensic evidence that does not exist on disk.

Question 2: In the NIST SP 800-61 framework, what is the critical difference between containment and eradication?

• Answer: Containment stops the attack from spreading further across the network (e.g., isolating a host from the VLAN). Eradication permanently removes all components of the threat from the environment (deleting malware, removing backdoor accounts, patching vulnerabilities). Containment must precede eradication.