Threat Intelligence and MITRE ATT&CK

Incident Classification and Severity

Not every alert is a P1 incident. A severity framework: P1 (Critical) — active ransomware, ongoing data exfiltration, complete system compromise; P2 (High) — confirmed malware on multiple systems, compromised admin account; P3 (Medium) — single malware infection, policy violation; P4 (Low) — false positive, blocked attack attempt. Severity drives response time, staffing, and management notification requirements.

SOC Tools: SOAR and Case Management

SOAR (Security Orchestration, Automation, and Response) automates response actions triggered by SIEM alerts: isolating an infected host via EDR API, blocking a C2 IP in the firewall, and creating a ticket in the case management system. Platforms: Palo Alto XSOAR, Splunk SOAR, TheHive (open source). Case management tracks the full investigation lifecycle: evidence, timeline, analyst notes, and closure.

Communication During an Incident

Internal communication: IT leadership notified within 1 hour of P1 confirmation, senior management within 2 hours, legal/compliance within 4 hours. External communication: customers if PII is breached (GDPR 72-hour notification requirement, state breach notification laws). Law enforcement: FBI CyberDivision for nation-state/ransomware. Public statement: legal reviews before any external disclosure. Never confirm or deny to media during active incident.

# TheHive case creation via API
# POST /api/case
{
  "title": "P2: Suspected Cobalt Strike Beacon - WORKSTATION-42",
  "severity": 2,
  "tlp": 2,
  "tags": ["cobalt-strike", "lateral-movement", "T1059.001"],
  "description": "Sysmon detected powershell.exe network connection to "
                  "known Cobalt Strike team server 198.51.100.10:443. "
                  "Host isolated via CrowdStrike. Investigation ongoing.",
  "tasks": [
    {"title": "Isolate host", "status": "Completed"},
    {"title": "Memory acquisition", "status": "InProgress"},
    {"title": "Identify patient zero", "status": "Waiting"},
    {"title": "Scope lateral movement", "status": "Waiting"},
    {"title": "Draft stakeholder notification", "status": "Waiting"}
  ]
}