Overview
Once something is detected, responders must understand it before acting. Analysis (paired with detection in the NIST lifecycle) determines whether an alert is a real incident, what is happening, how serious it is, and what scope it has. Good analysis prevents both overreaction and underreaction.
Learning objectives
- Explain the goal of the analysis phase.
- Describe triage, scoping, and prioritization.
- Understand why accurate analysis guides the whole response.
Core concept
Analysis turns a raw alert into an understood incident. It involves:
- Validation / triage — is this a true incident or a false positive?
- Scoping — which systems, accounts, and data are affected? How did the attacker get in and how far have they gone?
- Severity and impact assessment — how damaging is it, using the CIA lens (confidentiality/integrity/availability impact)?
- Prioritization — given limited responders, which incidents (or parts) get attention first?
How it works
Analysts investigate using logs, alerts, and affected systems to build a picture of the incident, often reconstructing a timeline of attacker actions. They classify the incident type (malware, phishing, data breach, DoS) and assess impact to set priority. This analysis directly shapes containment: you cannot contain what you have not scoped. Analysis and detection loop tightly — new findings may reveal more affected systems, feeding back into scoping.
Practical example
An alert flags malware on one laptop. Analysis reveals the same malware family on two other machines and a suspicious admin login — so the incident is broader than one laptop. Scoping also shows the attacker reached a file server but analysis of transfer logs finds no data left the network yet. This understanding sets the severity as high but pre-exfiltration, and directs containment to all three hosts plus the admin account — not just the first laptop.
Cybersecurity relevance
Analysis is core investigative work in a SOC and the foundation of digital forensics. Its accuracy determines whether the response is proportionate and complete; misjudged scope leads either to wasted effort or to missed footholds that let the attacker return.
Common mistakes
- Acting before scoping, containing one machine while the attacker persists on others.
- Misjudging severity, over- or under-reacting.
- Poor documentation during analysis, losing the timeline needed for later phases and reporting.
Key takeaways
- Analysis validates, scopes, and prioritizes a detected incident and assesses its impact.
- It reconstructs what happened and how far the attacker reached, guiding containment.
- Accurate analysis makes the whole response proportionate and complete; poor scoping lets attackers persist.
Check your understanding
- Why must scoping happen before containment?
- What does "triage" mean in the context of incident analysis?