Process
A simple, secure lifecycle designed to reduce risk quickly.
-
1
Onboard
Connect SIEM/EDR/IDP; define playbooks & comms.
-
2
Monitor
Detect anomalies, malware, identity abuse, lateral movement.
-
3
Triage
Validate, enrich, classify alerts; escalate if needed.
-
4
Respond
Contain endpoints, reset credentials, coordinate stakeholders.
-
5
Improve
Post‑incident review → new rules, hardening, and drills.