5.2.1. Incident Management Tools and Techniques

💡 First Principle: Detection and response tooling exists to compress the time between "something happened" and "we know what happened," because every minute of that gap is a minute an attacker operates freely and evidence continues to change.

A SIEM (Security Information and Event Management platform) correlates log data across the environment to surface anomalies that a single system's logs wouldn't reveal alone. Forensic tools capture and preserve evidence (disk images, memory captures) in a way that survives later legal or regulatory scrutiny. An incident tracking system maintains a documented timeline of every action taken during response — which matters both operationally and later, during post-incident review (5.2.5) and any regulatory inquiry. Threat hunting extends this proactively, searching for indicators of compromise that automated detection hasn't yet alerted on.

⚠️ Exam Trap: Tooling questions often test whether you understand a tool's purpose (detection versus evidence preservation versus documentation) rather than its brand name — know what each category of tool is for, not just what it's called.

Reflection Question: Your SIEM generates an alert, but no one logs the specific actions taken in response until three days later, from memory. What operational and evidentiary risk does this create?