Detection & Incident Response

Detection engineering, the incident-response lifecycle, malware triage and forensics, and reading adversary techniques as telemetry rather than procedures to fear.

IT Abyss

Detection & Incident Response

Detection and response is the discipline of the "assume breach" world. Firewalls, patches and MFA reduce how often an intruder gets in, but never to zero — so a mature defender is measured not by whether they are breached, but by dwell time: how long the attacker operates unseen, and how completely they are removed. This topic builds the defender's mental model end to end, framing every attacker move as something you recognise in telemetry rather than a procedure to memorise.

We move from turning raw logs into durable detections, through the disciplined lifecycle of handling a live incident, into triaging malware safely, and finally into reading adversary tradecraft as signals. Along the way we name the traps interviewers use: base rates make rare-event detection hard, alert fatigue is itself a security failure, preparation dominates incident response, memory is captured before disk, hashes are brittle while TTPs are durable, and blocking ports does not stop command-and-control.

Topic map

Detection engineering — log sources, the detection lifecycle, signature vs anomaly vs behavioural, why base rates make rare-event detection hard, and MITRE ATT&CK plus the pyramid of pain as coverage frameworks.
Incident response — the PICERL lifecycle and why preparation dominates, the containment trade-off, order of volatility, chain of custody, scoping before eradication, and blameless postmortems.
Malware forensics — static vs dynamic analysis, safe handling, file identification, recognising packing, accounting for sandbox evasion, and memory forensics — strictly recognising and triaging.
Adversary techniques — the kill chain and ATT&CK as a detection lens, living-off-the-land, credential access and MFA, lateral movement and segmentation, C2 traffic, and exfiltration — each as "what it looks like in telemetry plus the countermeasure".

Interview relevance

These questions test whether you reason about detection as an engineering and evidence problem, not a shopping list. The candidate who says "I tier log sources by detection value, tune for base rates so analysts are not drowned, and hunt on durable TTPs rather than rotatable hashes" is miles ahead of one who answers every question with "buy an EDR". Common wrong answer: "we block the malicious IPs and hashes and we're covered" — indicators at the bottom of the pyramid of pain expire in minutes, and detection that lives on them expires with them.

advanced

Detection & Incident Response

Detection engineering, the incident-response lifecycle, malware triage and forensics, and reading adversary techniques as telemetry rather than procedures to fear.

security-detection-response

Practice: 12 questions →

Sections

Contents

Detailed explanation

Detection & Incident Response

Topic map

Detection engineering — log sources, the detection lifecycle, signature vs anomaly vs behavioural, why base rates make rare-event detection hard, and MITRE ATT&CK plus the pyramid of pain as coverage frameworks.
Incident response — the PICERL lifecycle and why preparation dominates, the containment trade-off, order of volatility, chain of custody, scoping before eradication, and blameless postmortems.
Malware forensics — static vs dynamic analysis, safe handling, file identification, recognising packing, accounting for sandbox evasion, and memory forensics — strictly recognising and triaging.
Adversary techniques — the kill chain and ATT&CK as a detection lens, living-off-the-land, credential access and MFA, lateral movement and segmentation, C2 traffic, and exfiltration — each as "what it looks like in telemetry plus the countermeasure".

Interview relevance

Why it matters

Prevention eventually fails, so the real question is how fast you see the intruder and how cleanly you evict them. An engineer who cannot turn raw logs into durable detections, run a disciplined incident lifecycle, triage a sample without becoming its next victim, or read an attacker technique as a signal in the telemetry will discover the breach from the news, not the SIEM. A defensive interview tests exactly this: the mental model, not a list of tools.

Detection & Incident Response

Detection engineering, the incident-response lifecycle, malware triage and forensics, and reading adversary techniques as telemetry rather than procedures to fear.

IT Abyss

Detection & Incident Response

Topic map

Detection engineering — log sources, the detection lifecycle, signature vs anomaly vs behavioural, why base rates make rare-event detection hard, and MITRE ATT&CK plus the pyramid of pain as coverage frameworks.
Incident response — the PICERL lifecycle and why preparation dominates, the containment trade-off, order of volatility, chain of custody, scoping before eradication, and blameless postmortems.
Malware forensics — static vs dynamic analysis, safe handling, file identification, recognising packing, accounting for sandbox evasion, and memory forensics — strictly recognising and triaging.
Adversary techniques — the kill chain and ATT&CK as a detection lens, living-off-the-land, credential access and MFA, lateral movement and segmentation, C2 traffic, and exfiltration — each as "what it looks like in telemetry plus the countermeasure".

Interview relevance

Detection & Incident Response

Topic map

Detection engineering — log sources, the detection lifecycle, signature vs anomaly vs behavioural, why base rates make rare-event detection hard, and MITRE ATT&CK plus the pyramid of pain as coverage frameworks.

Incident response — the PICERL lifecycle and why preparation dominates, the containment trade-off, order of volatility, chain of custody, scoping before eradication, and blameless postmortems.

Malware forensics — static vs dynamic analysis, safe handling, file identification, recognising packing, accounting for sandbox evasion, and memory forensics — strictly recognising and triaging.

Adversary techniques — the kill chain and ATT&CK as a detection lens, living-off-the-land, credential access and MFA, lateral movement and segmentation, C2 traffic, and exfiltration — each as "what it looks like in telemetry plus the countermeasure".

Interview relevance