## The IR Lifecycle (NIST 800-61)

The Bible of Incident Response is **NIST Special Publication 800-61r2**. It defines the four phases of the lifecycle.

### 1. Preparation
This happens *before* the attack.
*   **Action**: Establishing the CSIRT, buying tools, writing playbooks, setting up communication channels.
*   **Key**: If you aren't prepared, you have already failed.

### 2. Detection & Analysis
This is where the SOC lives.
*   **Action**: Monitoring the SIEM, triaging alerts, determining if it is a False Positive or a Real Incident.
*   **Key**: Determining the **Scope**. Is it 1 laptop? Or the entire Domain?

### 3. Containment, Eradication, & Recovery
The "Fix it" phase.
*   **Containment**: Stop the spread. (Isolation).
*   **Eradication**: Remove the threat (Delete malware, disable accounts).
*   **Recovery**: Restore data from backups, patch vulnerabilities, return to normal.

### 4. Post-Incident Activity (Lessons Learned)
The most important, yet most ignored phase.
*   **Action**: A meeting 2 weeks later. "What went wrong? Why didn't we catch it sooner? How do we improve?"
*   **Output**: New SIEM rules, new Playbooks, better tools.

### The Feedback Loop
It is a cycle. The "Lessons Learned" feed back into "Preparation".
*   "We got hacked because we didn't have MFA."
*   Lesson: Need MFA.
*   Preparation: Implement MFA.
*   Result: Next time, that attack fails.

### Alternative Model: SANS PICERL
SANS breaks it down slightly differently (6 steps):
1.  **P**reparation
2.  **I**dentification (Detection)
3.  **C**ontainment
4.  **E**radication
5.  **R**ecovery
6.  **L**essons Learned