WEBVTT 0:00:03.300000 --> 0:00:05.860000 Hello everyone and welcome. 0:00:05.860000 --> 0:00:11.320000 In this video we are finally going to discuss event triage and investigation 0:00:11.320000 --> 0:00:15.400000 but more specifically we're going to be looking at it from the perspective 0:00:15.400000 --> 0:00:20.260000 of a workflow and the reason for that will become apparent. 0:00:20.260000 --> 0:00:25.360000 So what the objective of this video is is to explain what event triage 0:00:25.360000 --> 0:00:31.920000 is, how it works and more importantly how this ties into investigation 0:00:31.920000 --> 0:00:36.000000 and what will underpin this is the workflow, the typical workflow that 0:00:36.000000 --> 0:00:38.540000 you will encounter. 0:00:38.540000 --> 0:00:44.120000 So without wasting too much time, event triage, what is it? 0:00:44.120000 --> 0:00:46.940000 Because I've mentioned it a few times in this course and if you're not 0:00:46.940000 --> 0:00:51.900000 familiar with this process then this is arguably the best time to get 0:00:51.900000 --> 0:00:57.000000 into it. So event triage is the process of analyzing and categorizing 0:00:57.000000 --> 0:01:02.080000 security alerts or events in order to determine whether they indicate 0:01:02.080000 --> 0:01:06.400000 a potential security incident, a false positive because there's going 0:01:06.400000 --> 0:01:11.260000 to be plenty of those or just a benign activity. 0:01:11.260000 --> 0:01:16.140000 So the goal or objective is to quickly assess the relevance and severity 0:01:16.140000 --> 0:01:21.820000 of an event and decide on the appropriate next steps. 0:01:21.820000 --> 0:01:25.560000 Now if you're familiar, if you have worked in a SOC you're probably also 0:01:25.560000 --> 0:01:35.840000 thinking about explains that as well and the escalation process depending 0:01:35.840000 --> 0:01:40.060000 on severity and stuff like this but before we get into that you need to 0:01:40.060000 --> 0:01:42.740000 understand the triage process. 0:01:42.740000 --> 0:01:50.520000 So what does event triage entail or what does it include in terms of activities? 0:01:50.520000 --> 0:01:56.680000 So firstly we have the alert review process, we have filtering false positives, 0:01:56.680000 --> 0:02:01.960000 severity assessment which I mentioned just a few seconds ago, the initial 0:02:01.960000 --> 0:02:05.560000 investigation which we'll get to in this video and then the escalation 0:02:05.560000 --> 0:02:10.380000 decision which I also mentioned a few seconds ago. 0:02:10.380000 --> 0:02:16.980000 So you can all see that the escalation process ties into this quite significantly 0:02:16.980000 --> 0:02:20.060000 but let's not get ahead of ourselves. 0:02:20.060000 --> 0:02:23.320000 So when we talking about a alert review, what does this entail? 0:02:23.320000 --> 0:02:28.980000 Well this involves analyzing alerts generated by security tools or technologies 0:02:28.980000 --> 0:02:35.580000 like the SEAM, EDR or the intrusion detection or intrusion prevention 0:02:35.580000 --> 0:02:41.300000 systems. You then have filtering false positives, this involves identifying 0:02:41.300000 --> 0:02:46.320000 and dismissing non-threatening or you know routine events, events that 0:02:46.320000 --> 0:02:48.540000 are generally normal. 0:02:48.540000 --> 0:02:52.080000 You then have severity assessment which is very important. 0:02:52.080000 --> 0:02:56.260000 So this is where you classify the event based on potential impact and 0:02:56.260000 --> 0:03:00.640000 risk level. Okay so don't worry we'll get into what that means exactly 0:03:00.640000 --> 0:03:05.340000 in you know we're talking about impact and risk but then we also have 0:03:05.340000 --> 0:03:09.260000 another activity which is you know initial investigation. 0:03:09.260000 --> 0:03:14.860000 So this is where you check logs, use activity and system behavior for 0:03:14.860000 --> 0:03:21.380000 anomalies. So if you see that the accountants workstation all of a sudden 0:03:21.380000 --> 0:03:27.580000 you know has a PowerShell session opened up or you essentially detect 0:03:27.580000 --> 0:03:31.080000 that there's a PowerShell session that has been opened up or executed 0:03:31.080000 --> 0:03:37.440000 on a system that again historically over time you haven't seen or you 0:03:37.440000 --> 0:03:41.360000 haven't monitored that activity to be normal then you know that's not 0:03:41.360000 --> 0:03:45.880000 normally. So you know I just wanted to give you a bit of perspective as 0:03:45.880000 --> 0:03:50.440000 to what that means or you're talking about a normally based detection. 0:03:50.440000 --> 0:03:54.920000 But we then finally have escalation decision or the escalation process 0:03:54.920000 --> 0:03:59.480000 as it were. So this is where you decide whether the event should be escalated 0:03:59.480000 --> 0:04:01.480000 for further investigation. 0:04:01.480000 --> 0:04:07.440000 So you know what this process involves is you sort of understanding what 0:04:07.440000 --> 0:04:12.440000 you've found and then based on various factors coming to a decision as 0:04:12.440000 --> 0:04:17.140000 to whether you can handle this or whether it needs a digital investigation 0:04:17.140000 --> 0:04:22.740000 or and if so you know who to escalate it to. 0:04:22.740000 --> 0:04:26.140000 So that brings us to event investigation. 0:04:26.140000 --> 0:04:30.760000 So what is event investigation in the context of a SOC and also incident 0:04:30.760000 --> 0:04:33.140000 response to a certain degree? 0:04:33.140000 --> 0:04:38.560000 Well event investigation is the process of conscientious analyzing validated 0:04:38.560000 --> 0:04:44.840000 security events key word there is conscientious and I would also add validating 0:04:44.840000 --> 0:04:50.840000 or validated. So event investigation is the process of conscientious analyzing 0:04:50.840000 --> 0:04:56.800000 validated security events to determine A the root cause B the scope and 0:04:56.800000 --> 0:05:02.500000 C the impact of A or V potential security incident. 0:05:02.500000 --> 0:05:06.740000 So the objective is really to gather enough or as much information as 0:05:06.740000 --> 0:05:11.600000 possible to understand the attack or the threat as it were mitigate the 0:05:11.600000 --> 0:05:13.740000 threat and prevent future occurrences. 0:05:13.740000 --> 0:05:16.040000 We pretty much stop it in its tracks. 0:05:16.040000 --> 0:05:20.140000 So that's what you know event investigation is all about. 0:05:20.140000 --> 0:05:23.300000 So what does event investigation entail? 0:05:23.300000 --> 0:05:26.720000 Again this is something we've covered to a certain extent in this course. 0:05:26.720000 --> 0:05:31.440000 So a lot of this is going to seem quite familiar at this point but this 0:05:31.440000 --> 0:05:35.220000 is very important especially when we're talking about investigation. 0:05:35.220000 --> 0:05:38.540000 So we have some key activities. 0:05:38.540000 --> 0:05:44.560000 A root cause analysis B a tax code determination C threat hunting D forensics 0:05:44.560000 --> 0:05:49.900000 really collection the collection side of forensics and incident classification. 0:05:49.900000 --> 0:05:53.900000 So starting off with root cause analysis what does this entail? 0:05:53.900000 --> 0:05:58.120000 Well this entails determining how the event originated or where it originated 0:05:58.120000 --> 0:06:04.180000 from. So was it a fishing was it fishing or malware you know stuff like 0:06:04.180000 --> 0:06:08.660000 this you then have the attack scope determination which as the activity 0:06:08.660000 --> 0:06:11.680000 name suggests is fairly self-explanatory. 0:06:11.680000 --> 0:06:16.200000 So this is where you identify the affected systems users and data pretty 0:06:16.200000 --> 0:06:21.740000 much what you're trying to determine is what has this incident or you 0:06:21.740000 --> 0:06:26.020000 know let's say malware what has this malware affected has it affected 0:06:26.020000 --> 0:06:30.600000 you know these systems or how many systems has it affected how many users 0:06:30.600000 --> 0:06:34.700000 has it affected pretty much finding you know as it's as the name suggests 0:06:34.700000 --> 0:06:42.160000 the full scope of you know what has been affected spanning across you 0:06:42.160000 --> 0:06:47.620000 know employees employee information employees the various computer systems 0:06:47.620000 --> 0:06:51.840000 applications data databases pretty much anything that's valuable you need 0:06:51.840000 --> 0:06:57.160000 to sort of come to a you need to come to an understanding as to you know 0:06:57.160000 --> 0:07:04.580000 what the full extent of you know what what in totality has been affected. 0:07:04.580000 --> 0:07:08.360000 So you then have threat hunting so this is where you search for related 0:07:08.360000 --> 0:07:14.160000 suspicious activity or you know attack of footprints or you know sort 0:07:14.160000 --> 0:07:18.160000 of remnants of you know tools that they've used or you know artifacts 0:07:18.160000 --> 0:07:21.440000 stuff like they're not really artifacts but you're just trying to see 0:07:21.440000 --> 0:07:26.160000 whether you can find any suspicious or related suspicious activity you 0:07:26.160000 --> 0:07:30.760000 then have forensics more specifically the collection phase of digital 0:07:30.760000 --> 0:07:35.300000 forensics where you gather the logs you perform memory dumps and network 0:07:35.300000 --> 0:07:43.600000 you know you capture network traffic you know network capture or traffic 0:07:43.600000 --> 0:07:47.960000 dumps for analysis and then you have incident classification so this is 0:07:47.960000 --> 0:07:51.760000 where you confirm whether the event qualifies as an incident and document 0:07:51.760000 --> 0:07:58.860000 it so very very simple but very very important to understand. 0:07:58.860000 --> 0:08:05.020000 So now to sort of explain to you you know event triage and investigation 0:08:05.020000 --> 0:08:09.700000 and how they work together this is where the workflow comes into play 0:08:09.700000 --> 0:08:13.900000 and we're going to use a very common example or it really is a tabletop 0:08:13.900000 --> 0:08:20.080000 exercise if I'm being honest that sort of outlines or in this case you're 0:08:20.080000 --> 0:08:23.840000 not going to be assessed on any of this but I'm sort of going to be guiding 0:08:23.840000 --> 0:08:28.800000 you through so that you understand using this let's say simulated or fictional 0:08:28.800000 --> 0:08:35.460000 attack how you go from you know detection to triage to investigation and 0:08:35.460000 --> 0:08:37.120000 then instant response. 0:08:37.120000 --> 0:08:42.200000 So in this case the scenario is as follows an alert is triggered in the 0:08:42.200000 --> 0:08:47.080000 SOC by the SEAM indicating multiple failed login attempts on an internal 0:08:47.080000 --> 0:08:51.840000 server from an external IP address which is then followed by a successful 0:08:51.840000 --> 0:08:55.000000 login which is really an incident. 0:08:55.000000 --> 0:09:00.440000 So the primary concern is whether this is a brute force or whether this 0:09:00.440000 --> 0:09:03.780000 is a brute force attack or whether it's just a legitimate user who may 0:09:03.780000 --> 0:09:09.640000 be entered their password incorrectly a couple of times before getting 0:09:09.640000 --> 0:09:12.800000 it right and that's sort of the rationale or the mindset that you should 0:09:12.800000 --> 0:09:18.420000 have when you're talking about you know event triage and investigation. 0:09:18.420000 --> 0:09:22.180000 I wouldn't say that you need to keep an open mind but you know you really 0:09:22.180000 --> 0:09:28.100000 shouldn't jump to conclusions as to what is and what isn't malicious. 0:09:28.100000 --> 0:09:33.980000 So in this particular in the net you know in this slide as well as the 0:09:33.980000 --> 0:09:36.600000 ones that follow they're all linked to each other. 0:09:36.600000 --> 0:09:39.360000 So the numbering is very important. 0:09:39.360000 --> 0:09:42.780000 The environment is still the same I've just reordered a couple of you 0:09:42.780000 --> 0:09:47.560000 know a couple of the elements so that it's easily understood but don't 0:09:47.560000 --> 0:09:48.580000 worry I'm going to guide you. 0:09:48.580000 --> 0:09:52.620000 So we have the SOC here we have a tier one analyst and then the file server 0:09:52.620000 --> 0:09:58.480000 which is the system that's you know this is the system that's been affected 0:09:58.480000 --> 0:10:02.460000 by the brute force attack or legitimate login and then we have a SEAM 0:10:02.460000 --> 0:10:06.060000 here. So starting off with step one we can see that the SEAM and I'm going 0:10:06.060000 --> 0:10:09.060000 to switch into the full screen so you can see this. 0:10:09.060000 --> 0:10:13.460000 The SEAM system detects multiple fail login attempts on the company's 0:10:13.460000 --> 0:10:18.920000 critical file server this guy here from an unrecognized external IP. 0:10:18.920000 --> 0:10:23.260000 So step two the system the SEAM generates an alert and sends it to the 0:10:23.260000 --> 0:10:28.820000 SOC for triage. Step three the tier one SOC analyst begins triaging the 0:10:28.820000 --> 0:10:32.740000 alert by answering key questions and this is what I wanted to I am. 0:10:32.740000 --> 0:10:36.960000 This is what I wanted to illustrate you know the process of performing 0:10:36.960000 --> 0:10:42.340000 triage in the context of a real a real world example or a real world attack 0:10:42.340000 --> 0:10:43.800000 even though it's fictional. 0:10:43.800000 --> 0:10:45.880000 So we have the tier one analyst. 0:10:45.880000 --> 0:10:52.200000 So what does triage look like in terms of you know the real deal or in 0:10:52.200000 --> 0:11:00.260000 the real world? Well triage is really at least in this particular case 0:11:00.260000 --> 0:11:06.640000 in context the process of asking questions to sort of contextualize or 0:11:06.640000 --> 0:11:11.440000 to better understand what it is you know this particular alert or event 0:11:11.440000 --> 0:11:15.860000 is and whether it is a legitimate threat or incident or whether it's a 0:11:15.860000 --> 0:11:21.740000 false positive. So first question who triggered the alert or sorry not 0:11:21.740000 --> 0:11:23.520000 who what triggered the alert. 0:11:23.520000 --> 0:11:27.880000 So the tier one analyst is asking these questions and this can be enforced 0:11:27.880000 --> 0:11:31.120000 in the form of a playbook but for now let's keep it simple. 0:11:31.120000 --> 0:11:34.160000 So what triggered the alert? 0:11:34.160000 --> 0:11:38.660000 You go ahead and investigate and see how it's 15 fail login attempts followed 0:11:38.660000 --> 0:11:40.540000 by a successful login. 0:11:40.540000 --> 0:11:45.000000 Okay. So first things first there were 15 failed login attempts. 0:11:45.000000 --> 0:11:47.980000 What is the system that's affected is the file server. 0:11:47.980000 --> 0:11:53.420000 Okay. Secondly when we're talking about scope you know whether any other 0:11:53.420000 --> 0:11:57.780000 systems are part of the brute force attack not really no okay. 0:11:57.780000 --> 0:12:01.840000 So given that there was a successful login who is the user involved or 0:12:01.840000 --> 0:12:03.860000 what was the affected account? 0:12:03.860000 --> 0:12:07.500000 So you investigate and you find that it is an internal employee account 0:12:07.500000 --> 0:12:11.460000 in this case is john do at company.com. 0:12:11.460000 --> 0:12:16.300000 All right. So you've answered that question so nothing too crazy yet but 0:12:16.300000 --> 0:12:20.840000 then you have another question is the source IP familiar because again 0:12:20.840000 --> 0:12:25.840000 if you have historical data you'll be able to tell whether John Do has 0:12:25.840000 --> 0:12:29.860000 logged in from that IP address legitimately before. 0:12:29.860000 --> 0:12:35.300000 But what we find is that the IP is geo located in a foreign country where 0:12:35.300000 --> 0:12:37.480000 the employee doesn't typically work. 0:12:37.480000 --> 0:12:41.360000 So you know the alarm bells are ringing now. 0:12:41.360000 --> 0:12:45.660000 But then there's another key question to ask yourself is part of the triage 0:12:45.660000 --> 0:12:51.040000 process right. And that is are there any other related alerts. 0:12:51.040000 --> 0:12:55.300000 What we find through our investigation is that the SEAM system also shows 0:12:55.300000 --> 0:12:59.620000 that the user access sensitive files shortly after the login. 0:12:59.620000 --> 0:13:06.580000 Okay. So that takes us to step four or you know the fourth step in this 0:13:06.580000 --> 0:13:10.820000 process as it were where the analyst checks the employees login history 0:13:10.820000 --> 0:13:12.820000 and VPN usage logs. 0:13:12.820000 --> 0:13:17.620000 And over here you can see that no VPN session is active and the employees 0:13:17.620000 --> 0:13:19.880000 physically located in the corporate office. 0:13:19.880000 --> 0:13:24.040000 So this is very important because why would the employee if they're already 0:13:24.040000 --> 0:13:27.540000 at the office why would they log in externally. 0:13:27.540000 --> 0:13:32.900000 So that brings us to the second conclusion here which is the external 0:13:32.900000 --> 0:13:37.160000 IP suspicious and associated with previous brute force attacks in threat 0:13:37.160000 --> 0:13:38.240000 intelligence databases. 0:13:38.240000 --> 0:13:43.700000 So using the IP information you know as an indicator of compromise or 0:13:43.700000 --> 0:13:46.760000 you know performing a search to see whether it has been part of previous 0:13:46.760000 --> 0:13:51.680000 attacks not just limited to your organization but other organizations. 0:13:51.680000 --> 0:13:53.420000 And what's the conclusion? 0:13:53.420000 --> 0:13:57.860000 The conclusion by the tier one sock analyst is part of the triage process 0:13:57.860000 --> 0:14:03.640000 is that this is not a false positive and the event is valid and suspicious. 0:14:03.640000 --> 0:14:08.360000 Okay. Now the next question is what comes next and that brings us to the 0:14:08.360000 --> 0:14:11.340000 next phase which is the investigation process. 0:14:11.340000 --> 0:14:17.620000 Now I know I used you know I used that term previously or in the previous 0:14:17.620000 --> 0:14:20.620000 slide but now we're really getting into the investigation. 0:14:20.620000 --> 0:14:24.320000 So you can see it's still the same environment as a set of just move things 0:14:24.320000 --> 0:14:28.520000 around and we are still continuing sequentially from step four. 0:14:28.520000 --> 0:14:32.540000 So step five the tier one analyst performs an initial triage investigation 0:14:32.540000 --> 0:14:34.680000 which we've already done. 0:14:34.680000 --> 0:14:37.200000 Okay so check login times. 0:14:37.200000 --> 0:14:41.140000 So this is I'm sort of explaining the investigation process here. 0:14:41.140000 --> 0:14:45.680000 So check login times the successful login occurred at 3 a.m. 0:14:45.680000 --> 0:14:48.020000 an unusual time for the employee. 0:14:48.020000 --> 0:14:51.780000 Be reviewed the authentication logs the login was made via remote desktop 0:14:51.780000 --> 0:14:56.580000 protocol. See the threat intelligence look up so the source IP is known 0:14:56.580000 --> 0:14:58.520000 for brute force activity. 0:14:58.520000 --> 0:15:00.620000 D examine use activity. 0:15:00.620000 --> 0:15:04.540000 So post login the use access financial data files which is not typical 0:15:04.540000 --> 0:15:05.860000 for this account. 0:15:05.860000 --> 0:15:07.980000 So what's the conclusion here? 0:15:07.980000 --> 0:15:11.780000 The conclusion is that the event indicates a potential compromise and 0:15:11.780000 --> 0:15:14.580000 the alert is escalated for deeper investigation. 0:15:14.580000 --> 0:15:20.920000 So we have not discussed escalation in this video you know in in a detail 0:15:20.920000 --> 0:15:26.540000 or we haven't discussed it or we haven't gone through it you know with 0:15:26.540000 --> 0:15:30.080000 the detail that it deserves but we will be going through it in the next 0:15:30.080000 --> 0:15:34.540000 set of videos. In any case step six the incident is escalated to the tier 0:15:34.540000 --> 0:15:39.080000 two SOC and analyst or incident response team or you know the incident 0:15:39.080000 --> 0:15:41.840000 responder for further investigation. 0:15:41.840000 --> 0:15:48.320000 So step seven this is now being performed by the tier two analyst. 0:15:48.320000 --> 0:15:52.000000 So the tier two analyst begins an in -depth investigation and this this 0:15:52.000000 --> 0:15:54.240000 is sort of the results of the investigation. 0:15:54.240000 --> 0:15:58.700000 So what they do and what the results are so they perform log analysis. 0:15:58.700000 --> 0:16:03.080000 So you you know check windows event logs and confirms multiple fail login 0:16:03.080000 --> 0:16:08.140000 attempts. So they're now sort of confirming you know after it's been escalated 0:16:08.140000 --> 0:16:11.340000 to them they are now confirming all the stuff or they're checking it to 0:16:11.340000 --> 0:16:15.760000 validate. It's already been confirmed by the tier one analyst as a legitimate 0:16:15.760000 --> 0:16:21.560000 incident. So as part of log analysis you know they confirmed that the 0:16:21.560000 --> 0:16:24.580000 successful login came from the suspicious external IP. 0:16:24.580000 --> 0:16:28.920000 So you're confirming that stuff then we have endpoint analysis. 0:16:28.920000 --> 0:16:32.540000 So the tier two analyst or incident response team performs endpoint analysis 0:16:32.540000 --> 0:16:36.940000 and uses EDR tools to check the whole system for malware or unauthorized 0:16:36.940000 --> 0:16:41.960000 changes. The incident responder or the tier two analyst or the incident 0:16:41.960000 --> 0:16:45.760000 response team I'm using these three interchangeably because you know it 0:16:45.760000 --> 0:16:49.920000 can either be one just the tier two analyst or it could be you know fully 0:16:49.920000 --> 0:16:52.200000 fledged IR team. 0:16:52.200000 --> 0:16:56.120000 But what happens is they detect an unknown partial script that was executed 0:16:56.120000 --> 0:16:57.720000 shortly after login. 0:16:57.720000 --> 0:17:01.500000 Okay. So you know there's definitely an issue here and then we have network 0:17:01.500000 --> 0:17:07.080000 analysis. So the incident responder or the IR team finds data transfer 0:17:07.080000 --> 0:17:11.480000 logs indicating an attempt to exfiltrate data to an external server. 0:17:11.480000 --> 0:17:16.740000 Okay. So step eight which I've sort of outlined here we'll get to it shortly 0:17:16.740000 --> 0:17:21.980000 is scope and impact determination but that's the investigation workflow. 0:17:21.980000 --> 0:17:26.820000 That is still continued in the next slide here whereby we still have the 0:17:26.820000 --> 0:17:29.000000 same environment again of just smooth things around. 0:17:29.000000 --> 0:17:31.420000 Remember we're continuing sequentially. 0:17:31.420000 --> 0:17:39.040000 So in this slide we ended at you know part eight or step eight we now 0:17:39.040000 --> 0:17:42.580000 have step nine which is containment decision. 0:17:42.580000 --> 0:17:48.880000 So since it's an active compromise, immediate containment is required. 0:17:48.880000 --> 0:17:51.880000 So what are the actions taken by the tier two analyst or the incident 0:17:51.880000 --> 0:17:54.500000 responder or the incident response team? 0:17:54.500000 --> 0:17:58.660000 A, disable the compromised user account B isolate the affected server 0:17:58.660000 --> 0:18:02.820000 from the network C block the attacker's IP address on the firewall. 0:18:02.820000 --> 0:18:06.520000 Okay. Step 10 eradication and removal. 0:18:06.520000 --> 0:18:10.900000 So we're now sort of in the incident response phase but you know you can 0:18:10.900000 --> 0:18:16.640000 sort of see the NIST 861 lifecycle come into play here. 0:18:16.640000 --> 0:18:18.200000 We now have eradication and removal. 0:18:18.200000 --> 0:18:21.740000 So the IR team removes the unauthorized partial script and checks for 0:18:21.740000 --> 0:18:26.360000 persistence mechanisms like scheduled tasks or registry keys. 0:18:26.360000 --> 0:18:29.620000 They scan the system for any back doors or malware implants and finds 0:18:29.620000 --> 0:18:33.780000 none. Okay. They conduct a full malware scan to ensure this you know system 0:18:33.780000 --> 0:18:36.480000 integrity and then step 11 recovery. 0:18:36.480000 --> 0:18:40.460000 So the system is re-imaged and restored from a clean backup. 0:18:40.460000 --> 0:18:44.420000 Very important. The affected users credentials are reset and multi-factor 0:18:44.420000 --> 0:18:49.760000 authentication is enforced and the team reviews logs for the compromised 0:18:49.760000 --> 0:18:52.460000 accounts and finds none. 0:18:52.460000 --> 0:18:58.440000 And then finally, you know, step 12 which is sort of the final step here 0:18:58.440000 --> 0:19:02.200000 is documentation and rule updates so that they can better detect this 0:19:02.200000 --> 0:19:09.680000 in the future. So that hopefully that particular example sort of explains 0:19:09.680000 --> 0:19:14.720000 really I would say the incident detection and response process but also 0:19:14.720000 --> 0:19:19.640000 in this in the case of this example and these diagrams it also outlines 0:19:19.640000 --> 0:19:26.340000 the critical phases of or you know it explains and demonstrate what event 0:19:26.340000 --> 0:19:31.060000 triage looks like and how it works and escalation to a certain extent 0:19:31.060000 --> 0:19:35.300000 and then you know how the incident response team or the SOC tier 2 analyst 0:19:35.300000 --> 0:19:40.640000 or the incident responder sort of takes over and what they performed once 0:19:40.640000 --> 0:19:44.620000 an event, an incident has been confirmed. 0:19:44.620000 --> 0:19:49.160000 So the real focus of this video was on you know event triage and investigation 0:19:49.160000 --> 0:19:52.380000 and not really the incident response but I thought it would be very useful 0:19:52.380000 --> 0:19:54.000000 to cover that there. 0:19:54.000000 --> 0:19:57.820000 In any case, that was very very fun for me to actually go through that 0:19:57.820000 --> 0:20:02.380000 example but with that being said, I think that brings us to the end of 0:20:02.380000 --> 0:20:05.880000 this video and I'll be seeing you in the next video.