The NIST IR Lifecycle — Six Phases and SOC Ownership

The NIST IR lifecycle isn’t a checklist — it’s a mental model for knowing what phase you’re in, what decisions belong in that phase, and when to hand off to the next team. Every SOC analyst should be able to place any current incident in one of six phases at any moment.

The Six Phases

┌─────────────────────────────────────────────────────────┐
│                    1. PREPARATION                        │
│  Playbooks • Detection rules • Training • SOAR setup    │
│  Ownership: Security Eng + SOC leadership + IR team     │
└───────────────────────────┬─────────────────────────────┘
                            │
                            ▼
┌─────────────────────────────────────────────────────────┐
│              2. DETECTION & ANALYSIS                     │
│  Alert triage • Investigation • Classification           │
│  Ownership: SOC (L1 triage → L2 analysis)              │
└───────────────────────────┬─────────────────────────────┘
                            │
                   ┌────────┴────────┐
                   ▼                 ▼
        [False Positive]    [True Positive — escalate]
          Close ticket              │
                                    ▼
┌─────────────────────────────────────────────────────────┐
│                  3. CONTAINMENT                          │
│  Short-term: isolate, block, revoke                      │
│  Preserve evidence BEFORE remediation                    │
│  Long-term: reimage, rotate creds, add detection        │
│  Ownership: SOC (short-term) + IR team (long-term)     │
└───────────────────────────┬─────────────────────────────┘
                            │
                            ▼
┌─────────────────────────────────────────────────────────┐
│                  4. ERADICATION                          │
│  Remove attacker artifacts, backdoors, persistence       │
│  Patch vulnerability used for initial access            │
│  Ownership: IR team + IT operations                     │
└───────────────────────────┬─────────────────────────────┘
                            │
                            ▼
┌─────────────────────────────────────────────────────────┐
│                   5. RECOVERY                            │
│  Restore systems • Monitor for recurrence               │
│  Verify normal operations restored                      │
│  Ownership: IT operations + IR team                     │
└───────────────────────────┬─────────────────────────────┘
                            │
                            ▼
┌─────────────────────────────────────────────────────────┐
│             6. POST-INCIDENT ACTIVITY                    │
│  Lessons learned • Incident report • Process improvement │
│  Ownership: SOC + IR team + security engineering        │
└─────────────────────────────────────────────────────────┘

Phase 2: Detection & Analysis — The SOC Core

This is where SOC analysts spend most of their time. The key outputs are:

Alert disposition — FP or TP (or Benign-TP or escalate)
Enriched investigation ticket — with all pivots and evidence
Incident classification — severity, ATT&CK techniques, affected scope
Escalation package — if TP, everything L2 and IR need to continue

The critical classification decisions:

Question	Answer determines
Is this a TP?	Whether to contain or close
What is the blast radius?	Severity level (P1-P4)
Is there active attacker presence?	Speed of response (minutes vs. hours)
What phase of the attack is this?	Which playbook drives next steps
Has data left the network?	Whether breach notification is required

Phase 3: Containment — Two Modes

Short-term Containment (SOC Owns)

Immediate, reversible actions to stop the bleeding:

Host isolation: EDR isolation (reversible — IR team can still access the host)
Session revocation: Cut off attacker’s active access
Network block: C2 IP/domain (per M19 containment action format)
Email quarantine: Remove phishing email from mailboxes

Evidence preservation happens BEFORE containment actions:

Preserve first (can't undo remediation):
  ✓ Export email headers and original email
  ✓ Collect Zeek pcap or conn.log segment for incident timeframe
  ✓ Export M365 UAL for affected accounts (time-bounded export)
  ✓ Export Sysmon events from affected host (before reimaging)
  ✓ Capture host memory dump if possible (volatile evidence)

Then contain:
  → Isolate host
  → Revoke sessions
  → Block network indicators

Long-term Containment (IR Team Owns)

After short-term containment and evidence collection:

Reimage compromised hosts to known-good state
Rotate all passwords used on compromised systems
Deploy temporary detection rules for attacker’s TTPs
Remove attacker-established persistence (services, scheduled tasks, inbox rules)

Phase 6: Post-Incident Activity — The Improvement Loop

This phase is most often skipped under time pressure — and it’s the most valuable for long-term security improvement.

Three outputs:

Incident report — for stakeholders, compliance, and historical record
Lessons-learned document — what went right, wrong, and what to change
Improvement actions — detection rule updates, playbook changes, training

SOC Severity Classification

Before escalating, classify incident severity to set response SLA:

Priority	Criteria	SOC Response Target
P1 — Critical	Active breach, confirmed data exfiltration, C-suite compromise, DC compromise	Immediate — IR declared within 15 min
P2 — High	Confirmed malware on endpoint, AiTM session compromise, lateral movement	Response within 1 hour
P3 — Medium	Phishing email (no click), suspicious process (unconfirmed TP), policy violation	Response within 4 hours
P4 — Low	Informational, generic phishing blocked, known-FP pattern	Next business day review

Retrieval Practice

An analyst successfully contained a Cobalt Strike beacon, blocked the C2 IP, and isolated the host. Before reimaging the host, they forgot to capture the Sysmon event logs. The IR team later needs to know the initial execution vector. What happened and what should have been done?

Reveal answer

Reimaging destroyed the Sysmon event logs stored on the local host — volatile and host-resident evidence that was not forwarded to the SIEM in time (or the retention period didn't cover the initial compromise timestamp). The IR team cannot determine the initial access vector without the Sysmon process creation events showing what executed the malware. Should have done: before any containment action that modifies the host (especially before isolation + reimage), export all relevant logs — Sysmon events, Windows Event Logs (Security, System, Application), EDR telemetry — for the relevant time window. The SIEM may only retain recent logs; the host itself may have earlier events in Windows Event Log files (.evtx). Lesson learned: add 'export host logs' as a mandatory step in the containment checklist before host isolation.

Retrieval Practice

A P1 incident is declared. The SOC analyst asks: 'Should I finish fully documenting my investigation before handing to IR, or should I hand off immediately?' What is the correct answer?

Reveal answer

Hand off immediately for a P1 — active breach. In a P1 (active attacker, ongoing access), every minute of delay extends the attacker's dwell time. Hand off with whatever documentation exists now (even a partial ticket with key findings), communicate verbally or in real-time collaboration (Slack, call), and document the rest as you go — in parallel with IR team activity. A complete, well-documented ticket handed over 2 hours into an active breach is worse than an incomplete ticket handed over 10 minutes in. The principle: for active incidents, speed of hand-off > completeness of documentation. For P3/P4, completeness matters more than speed.