Post-Incident Activity

The attacker has been contained, eradicated, and the environment is clean. But the work is not finished. The final phase of the NIST incident response framework is Post-Incident Activity, the phase where the organization steps back, reflects on what happened, documents the findings, and uses everything learned to become harder to attack next time.

Learning Objectives

• Understand the purpose and importance of the Post-Incident Activity phase
• Learn what a lessons learned process involves and why it is commonly skipped
• Understand the differences between executive technical summary documents
• Learn how IOCs collected during an investigation become detection rules
• Use Splunk to reconstruct the full attack timeline and calculate dwell time
• Build detection rules from the IOCs discovered across the Nexus Financial investigation

Prerequisites

Although this room can be completed as a standalone, it is highly recommended to complete the following rooms before starting this one:

• Preparation
• Detection and Analysis
• Response and Recovery

Familiarity with Splunk SPL queries is required for the practical tasks. It is also recommended to complete the Microsoft 365 for the SOC module before starting this room.

Module Chain

This module follows a single security incident at Nexus Financial from start to finish across four rooms:

Note: This is Room 4 of 4 in the Incident Response module. This room brings everything together and closes the NIST IR cycle.