Cyber Incident Response: The 4 NIST Phases

NIST SP 800-61r2 (Computer Security Incident Handling Guide) remains the reference for structuring incident response. Not because it's an American document, but because the 4 phases it describes match operational reality exactly. The problem: 194 days of average dwell time (IBM 2025) prove that most organizations fail at Phase 2.

Phase 1: Preparation

Preparation is the most neglected and most critical phase. It breaks down into two areas:

Technical preparation

• Asset inventory: you can't protect what you don't know about. Network mapping, up-to-date CMDB, Shadow IT identified.

• Monitoring deployed: operational SIEM, EDR on endpoints, centralized logs (network, identity, cloud, application)

• Baseline established: what's "normal" on your network? Without a baseline, every alert is noise.

• Forensic tools ready: pre-configured forensic images, snapshot access, documented chain of custody

Organizational preparation

• Incident playbooks: not a 200-page document nobody reads. Two-page cheat sheets per scenario (ransomware, phishing, account compromise, data leak).

• Response team identified: who does what, up-to-date contacts, on-call rotations defined

• Crisis communication: pre-drafted templates for management, customers, regulators

• Regular exercises: one tabletop exercise per quarter minimum. Simulate the 2:17 AM Sunday scenario, who responds? How fast?

ThreatClaw covers the technical preparation in 48 hours: agent deployment, behavioral baseline in 14 days, 49 audit skills ready to go.

Phase 2: Detection and Analysis

This is where everything plays out, and where most organizations fail. Detection relies on three pillars:

• Signature-based detection: YARA, Sigma, Snort/Suricata rules. Effective against known threats. Useless against zero-days or LOLBins (Living Off The Land).

• Anomaly-based detection: ML/behavioral. Identifies deviations from baseline. This is what catches unknown threats, a user launching PowerShell for the first time, a server contacting a never-seen domain.

• Threat intelligence: IoC feeds (MISP, OTX, VirusTotal), correlation with active campaigns.

Analysis is the bottleneck. A SOC receives 4,500 alerts/day (Splunk 2024). The analyst must determine: is this a true positive? What's the impact? What's the scope? What are the next steps? This triage process takes 15-25 minutes per alert, which explains why 68% of alerts remain uninvestigated.

The ThreatClaw agent automates triage: multi-source correlation, contextual enrichment (is this alert about a production server or a dev workstation?), criticality scoring adapted to your environment. Triage time drops from 20 minutes to 3 seconds.

Phase 3: Containment, Eradication, and Recovery

Once the incident is confirmed, the clock is ticking.

Containment

Containment must be immediate and proportionate. Two strategies:

• Short-term containment: isolate the compromised system from the network (quarantine VLAN, switch port disable, EDR isolation). Goal: stop propagation without destroying evidence.

• Long-term containment: if eradication isn't immediate, set up temporary controls (firewall rules, account lockdowns, enhanced monitoring of adjacent systems).

The classic scenario: ransomware detected at 2:17 AM on a Sunday. Encryption has started. Every minute counts. In Autonomous mode, ThreatClaw isolates the machine in 90 seconds, blocks the compromised account, and captures a forensic snapshot before encryption spreads. In Hybrid mode, it sends you the proposed action and waits for approval, but by the time you see the SMS, it may be too late.

Eradication

• Identify and remove malware

• Close the entry vector (patch, disable vulnerable service)

• Reset compromised credentials

• Verify adjacent systems (lateral movement?)

Recovery

• Restore from verified backups (test your backups before the incident)

• Progressive return to production with enhanced monitoring

• Validate that the attacker hasn't left persistence (accounts, scheduled tasks, SSH keys)

Phase 4: Post-Incident Activity

The most commonly rushed phase. After an incident, you must:

• Blameless post-mortem: factual timeline, what worked, what failed, gaps identified

• Playbook updates: every incident should improve your preparation (back to Phase 1)

• Regulatory notifications: GDPR Art.33 (72h to DPA), NIS2 Art.23 (24h to CSIRT), and final report within a month

• Shared indicators of compromise: contribute to your sector's MISP

ThreatClaw automatically generates the incident timeline, technical report, and regulatory notification report. The post-mortem takes 2 hours instead of 2 days.

Human-in-the-Loop: the right balance

Full automation is scary, for good reason. The HITL (Human-in-the-Loop) concept is central. The question isn't "automate or not" but "automate what":

• Automate without hesitation: log collection, correlation, enrichment, notification, report generation

• Automate with approval: endpoint isolation, account blocking, firewall rule application

• Don't automate: crisis communication, ransom payment decisions, customer notification

ThreatClaw's three modes (Sentinel, Hybrid, Autonomous) map exactly to these trust levels. You set the dial.

FAQ

What's the difference between an incident and a security event?

An event is any observable occurrence on a system (login, file access, DNS query). An incident is an event or series of events that violates security policy or constitutes an imminent threat. All incidents are events, but less than 1% of events are incidents.

How long does it take to build an incident response team?

For an SMB, the response team is often the CISO + sysadmin + an external provider. Formal setup takes 2-4 weeks (role identification, contacts, procedures). The first tabletop exercise systematically reveals 5-10 critical gaps. Plan 3 months for operational maturity.

NIST or ISO 27035 for structuring incident response?

Both are valid. NIST SP 800-61 is more operational and concrete. ISO 27035 is more structured from a governance perspective and integrates better with an ISO 27001 ISMS. In practice, the phases are nearly identical. Choose based on your existing framework.

My organization has never had an incident. Why invest in response?

With all due respect: you've probably never detected an incident. 194 days of dwell time means attackers are often present without being spotted. The average breach cost in 2025 is $4.88M (IBM). Investing in detection and response isn't a cost, it's measurable insurance. Compare options.