A security technician receives an automated network intrusion detection system (NIDS) alert indicating potential unauthorized data exfiltration from an internal database server to an unknown external IP address. Place the following initial incident response steps in the correct chronological order, starting from initial alert verification to post-incident tuning.
- 1Validate the alert by examining network flow logs and raw packet captures.
- 2Determine the scope of the incident by identifying all endpoints communicating with the external IP address.
- 3Isolate the compromised internal database server from the network segment.
- 4Update NIDS signatures and log the incident details in the ticketing system.
Answer
The correct sequence begins with validating the NIDS alert using raw packet captures, followed by assessing the scope across network endpoints, isolating the compromised server to halt exfiltration, and concluding with signature updates and documentation.
The standard incident triage lifecycle starts with validating the telemetry alert to confirm malicious activity. Next, scoping is conducted to identify all impacted systems. Once scope is established, network containment (isolating the server) stops active data movement. Finally, post-incident activities such as signature updates and documentation ensure long-term mitigation.
Step-by-Step Solution
Key Concept
Network Incident Response and Alert Triage Sequencing