# The Incident Response Lifecycle (PICERL)

In the world of cybersecurity, it's not a matter of *if* an organization will be attacked, but *when*. When the inevitable happens, having a structured, repeatable process is the difference between a minor hiccup and a catastrophic data breach. 

The industry standard for this process is defined by NIST (National Institute of Standards and Technology) and SANS. We'll be focusing on the widely adopted 6-step SANS PICERL methodology.

## 1. Preparation
This is the most critical phase, and ironically, the one that happens *before* an incident occurs. You cannot respond to a fire if you don't have fire extinguishers, evacuation plans, and trained personnel.

**Key Activities:**
*   **Policy & Plan Creation:** Having an official Incident Response Plan (IRP).
*   **Asset Management:** Knowing what servers, endpoints, and data you are defending.
*   **Tooling:** Deploying EDR (Endpoint Detection & Response), SIEM, and ensuring logs are actually being collected and retained.
*   **Team Readiness:** Conducting tabletop exercises (IR drills) and ensuring the SOC team has the right access privileges.

## 2. Identification
Also known as Detection. This phase answers the question: "Are we currently compromised?"

**Key Activities:**
*   **Monitoring Alerts:** Reviewing SIEM alerts, IDS/IPS triggers, and EDR warnings.
*   **Triaging:** Filtering out false positives. If a user tries to log in over VPN 5 times and fails because they forgot their password, it's an event. If they succeed on the 100th try from an IP in a high-risk country, it's an incident.
*   **Declaring an Incident:** Officially escalating the event to a security incident so the IR plan can be enacted.

## 3. Containment
The bleeding must be stopped. The goal here is to limit the scope and magnitude of the incident. Containment is often split into two phases:

*   **Short-term Containment:** Immediate actions to stop the spread. E.g., isolating an infected laptop from the network, disabling a compromised VPN account, or pulling a server offline.
*   **Long-term Containment:** Temporary fixes to allow operations to continue while rebuilding the system. E.g., routing traffic through a newly built, clean proxy server.

## 4. Eradication
Once the threat is contained, it must be completely removed from the environment.

**Key Activities:**
*   **Removing Malicious Artifacts:** Deleting malware, reversing unauthorized registry changes, and removing persistence mechanisms (like cron jobs or scheduled tasks created by the attacker).
*   **Patching the Root Cause:** If the attacker got in via an unpatched Apache Struts vulnerability, that server must be patched right now, otherwise they will just come back.

## 5. Recovery
Bringing systems back into full production mode cautiously and verifying they are no longer compromised.

**Key Activities:**
*   **Restoring from Backups:** Rebuilding servers from clean, offline backups.
*   **Credential Resets:** Forcing enterprise-wide password resets if Active Directory was compromised.
*   **Monitoring Heightened:** Leaving increased monitoring on the affected systems for several weeks to ensure the attacker doesn't return.

## 6. Lessons Learned
Often skipped, but vital. This phase happens 1-2 weeks after the incident is closed.

**Key Activities:**
*   **Writing the Post-Mortem Report:** Documenting exactly what happened, chronological timeline, and the root cause.
*   **Process Improvement:** Asking "What did we do well?" and "What went wrong?". If containment took 4 hours because the SOC didn't have access to the firewall firewall console, the policy must be updated to give them access.

---
### Summary
Memorize the acronym **PICERL**: Preparation, Identification, Containment, Eradication, Recovery, Lessons Learned. As a DFIR analyst, your job spans across all these phases, heavily focusing on Identification, Containment, and Eradication.