Overview
Identification is the phase where the SOC determines that a security incident is actually occurring — distinguishing a true incident from routine alerts and defining its scope. It follows preparation and triggers all active response.
Learning objectives
- Define the identification phase of incident response.
- Explain how detection and triage lead to declaring an incident.
- Describe determining incident scope and severity.
Core concept
Identification (also called detection/analysis) is where the SOC recognizes that an incident is happening and confirms it. It builds directly on the detection and triage skills from earlier modules: alerts from SIEM, EDR, IDS, and user reports are triaged (module 6), enriched with context and threat intelligence (modules 7, 13), and analyzed to decide whether they represent a genuine incident rather than a false positive. When confirmed, the SOC declares an incident, assigns severity, and begins to determine scope — which systems, accounts, and data are affected. Accurate identification is critical: it starts the response clock, activates the IR plan and roles from preparation, and shapes every subsequent phase (you cannot contain what you have not scoped).
How it works
Identification begins when detection sources raise signals — a SIEM correlation alert, an EDR behavioral detection, an IDS signature match, or a user report. The analyst triages and enriches these (context, IOCs, threat intel) to separate true incidents from false positives and benign anomalies. Once an incident is confirmed, the SOC declares it per the IR plan, sets a severity (guiding urgency and who is engaged), and works to establish scope: which hosts, accounts, and data are involved, how the attacker got in, and how far they have spread — using EDR process trees, logs, and IOC pivoting. This scoping is iterative and continues as investigation reveals more. Clear identification hands off to containment (next lesson) with the information needed to act decisively. Under-identifying (missing affected systems) leads to incomplete containment; over-reacting to a false positive wastes resources — so disciplined analysis matters.
Practical example
An EDR behavioral alert and a correlated SIEM event point to a possible compromise on a workstation. The analyst triages and enriches: the indicators match known-malicious infrastructure (threat intel), and the EDR process tree shows suspicious persistence — this is a true incident, not a false positive. The SOC declares an incident, sets severity high, and begins scoping: pivoting on the IOCs across the SIEM reveals the same indicators on two other hosts and one account. Now the team knows the incident spans three hosts and one account — information that lets containment (next phase) isolate everything affected rather than just the first host. This is identification done well: confirm, declare, and scope before containing.
Cybersecurity relevance
Identification is the pivot from monitoring to active response: it applies the detection, triage, enrichment, and threat-intelligence skills from earlier modules to confirm a real incident, declare it, and establish scope and severity. It starts the response timeline and activates the roles and playbooks from preparation. Its quality bounds everything after it — accurate scoping enables complete containment and eradication, while missed affected systems leave attacker footholds. Identification is therefore the analytical heart of the lifecycle, turning raw detections into a defined, scoped incident the team can act on.
Common mistakes
- Declaring an incident on an unverified alert (false positive) or, conversely, dismissing a real incident as noise.
- Failing to scope — containing the first host found while missing other affected systems and accounts.
- Not setting severity, so the response lacks appropriate urgency and stakeholder engagement.
Key takeaways
- Identification confirms a genuine incident, declares it, and determines its severity and scope.
- It builds on detection, triage, enrichment, and threat intelligence to separate true incidents from false positives.
- Accurate scoping is essential — it enables complete containment and shapes every later phase.
Check your understanding
- How does the SOC move from raw alerts to declaring a confirmed incident?
- Why must scope be established during identification before containment begins?