Threat Detection & Response Checklist
An executable checklist for detecting, triaging and responding to security events — before, during and after.
Quick Answer
Run detection & response as a checklist: before — define triggers and triage criteria and pre-stage tooling; during — contain only after preserving evidence and record every action; after — verify removal, restore monitoring and extract lessons.
Definition
A directly executable checklist that turns the incident-response lifecycle into discrete, verifiable actions for detection and response.
Before (prepare)
- Define alert triggers and triage criteria (false-positive rates per source).
- Pre-stage tooling and access: hashing, IOC lookup, DNS lookup, CVE lookup.
- Maintain tested incident-response playbook and an on-call roster.
During (detect & triage)
- Before any action, preserve volatile evidence (memory/connections/sessions) and hash artifacts.
- Correlate ≥2 evidence streams to confirm the alert as a real incident.
- Verify indicators against Threat Intelligence (IOC lookup) — do not block/trust on a single signal.
- Log every analyst action with timestamp (chronological record).
During (respond)
- Contain only after evidence capture: disconnect/isolate host, disable account/credentials.
- Block confirmed C2 domains/IPs at the network boundary.
- Patch the exploited weakness; rotate exposed secrets from a clean system.
After (verify & recover)
- Re-scan and re-hash to confirm removal of persistence/backdoor.
- Restore from clean backups; validate integrity; reinstate monitoring at higher level.
- Declare all-clear only after re-verification and a full-trust rebuild.
Verification & Escalation
- Verify no re-infection/propagation in the following 72 hours.
- Escalate to incident commander / legal / comms if regulated data or P0 breadth is involved.
See guides:incident-response-playbook for the full procedure.
References
Have a follow-up question?
Ask AI about this Start an investigation Ask OpenTrojan's evidence-backed assistant about this topic — answers cite their sources.