## Phase 2: Detection & Analysis - The Alarm

This is the phase where the "Boom" happens (or where we notice it).

### Vectors of Detection
*   **Users**: "My computer is acting weird." "I clicked a link and now I have a popup."
*   **SIEM**: "Correlation Rule: Malware Beacon detected."
*   **Third Party**: "FBI calls and says they found your data on the Dark Web." (The worst way to find out).

### Triage (The ER Doctor)
When an alert triggers, you must Triage.
1.  **Validate**: Is it real? (False Positive check).
2.  **Categorize**:
    *   *Category*: Malware, Denial of Service, Unauthorized Access, Harassment.
3.  **Prioritize**:
    *   *Impact*: High/Med/Low.
    *   *Urgency*: High/Med/Low.
    *   *Scenario*:
        *   Ransomware on CEO laptop -> **Critical**.
        *   Adware on a Guest WiFi laptop -> **Low**.

### Scoping
Once confirmed, you need to determine the **Blast Radius**.
*   "We found malware on Host A. Is it also on Host B? C? D?"
*   Check SIEM for similar traffic.
*   Check File Hashes on entire fleet.
*   **Golden Rule**: Assume you only developed 10% of the breach. Keep digging.

### Analysis
*   Forensics: Disk and Memory analysis.
*   Malware Analysis: Reverse engineering samples found.
*   Log Analysis: Tracing the attacker's lateral movement.

### Documentation during Analysis
Every command you run, every file you touch, you must **Document**.
*   "10:05 AM: Reviewed firewall logs."
*   "10:10 AM: Isolated Host A."
*   "10:25 AM: Found sample in C:Temp."
This is crucial for legal reasons later.