## What is Incident Response?

**Incident Response (IR)** is the structured approach to addressing and managing the aftermath of a security breach or cyberattack. The goal is to handle the situation in a way that limits damage and reduces recovery time and costs.

### Incident vs. Event
*   **Event**: Any observable occurrence in a system.
    *   *Example*: User login, firewall deny, file creation.
    *   *Count*: Millions per day.
*   **Alert**: An event that triggers a warning based on a rule.
    *   *Example*: 10 Failed logins.
*   **Incident**: A violation of security policies that threatens CIA (Confidentiality, Integrity, Availability).
    *   *Example*: Data breach, Malware infection, Denial of Service.
    *   *Count*: Hopefully rare.

### Why do we need a Process?
When a breach happens, panic sets in.
*   "Pull the plug!"
*   "Wipe the server!"
*   "Call the police!"
*   "Don't tell anyone!"
Without a plan, people make mistakes. They destroy evidence (rebooting wipes memory). They tip off the attacker. They violate legal requirements.
IR is about **Organized Chaos Control**.

### The Computer Security Incident Response Team (CSIRT)
The team responsible for IR.
*   **Technical**: SOC Analysts, Forensics Experts, Malware Engineers.
*   **Non-Technical**:
    *   **Legal**: "Do we have to notify the government? The customers?"
    *   **PR/Comms**: "What do we tell the press?"
    *   **HR**: "Was it an insider? Do we fire them?"
    *   **Management**: Approves decisions (e.g., "Shut down the ecommerce site").

### The Goal of IR
1.  **Contain**: Stop the bleeding.
2.  **Eradicate**: Remove the infection.
3.  **Recover**: Get back to business.
4.  **Learn**: Don't let it happen again.