SANS Incident Handler's Handbook and PICERL Methodology
Phase 2: Identification – SANS Incident Handler's Handbook and PICERL Methodology

SANS Incident Handler's Handbook and PICERL Methodology I-1: I-1 Detect and decide whether an event is an incident using logs, error messages, IDS and firewall data, and report it promptly

The team gathers events from log files, system error output, intrusion detection alerts, firewalls and similar sources to determine whether a deviation from normal operation is an incident and, if so, its scope; a confirmed incident is reported as soon as possible so the team has time to collect evidence. Indicators range from a user reporting odd behaviour to the help desk, unusual network traffic or log entries never seen before, to a lost storage device or a found USB drive that runs malicious code when plugged in.

Maintained by Gerard BlokdykControl text last updated

Other controls in Phase 2: Identification – SANS Incident Handler's Handbook and PICERL Methodology

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll SANS Incident Handler's Handbook and PICERL Methodology controls