CyArt Academy
Unlock ProSign in
CYART // SCHEMA · EDR-TELEMETRY7 NODES · 7 LINKSEVENTSVERDICTCOMMANDACTOR · Endpoints — 50k agents, 1 kB/s eachACTOR01Endpoints50k agents, 1 kB/s eachEDGE · Ingest gateway — mTLS, per-agent tokenEDGE02Ingest gatewaymTLS, per-agent tokenSTREAM · Buffer — Kafka, 72 h retentionSTREAM03BufferKafka, 72 h retentionSERVICE · Real-time rules — Sigma, 1 s budgetSERVICE04Real-time rulesSigma, 1 s budgetSERVICE · Batch analytics — hunting, baselinesSERVICE05Batch analyticshunting, baselinesEDGE · Response — isolate host, kill procEDGE06Responseisolate host, kill procDATA · Data lake — Parquet, 1 yDATA07Data lakeParquet, 1 y

Incident response engineering

Runbooks as code, containment that is one click, evidence that holds up, and the automation boundary: what SOAR should and should not do alone.

🔒 PROLesson·14 min read·Intermediate → Staff
incident responseSOARcontainmentforensics

01Contain first, then understand

✓What you will learn
  • Order triage, contain, eradicate, recover, learn and know what each needs
  • Run an incident with clear roles and severity levels
  • Build one-click containment actions with guardrails
  • Decide what automation may do without a human
  • Write runbooks as code and measure response with real metrics

Incident response is an engineering problem as much as a process one. The NIST SP 800-61 lifecycle (preparation; detection and analysis; containment, eradication and recovery; post-incident activity) describes what happens. The engineering question is how much of it you can build in advance so that at 3 a.m. responders are choosing between ready actions, not writing scripts.

PhaseGoalNeeds in place beforehand
TriageIs it real, how bad, who leads?Severity rubric, on-call rota, case template
ContainStop the spread and the bleedingPre-built, authorised actions: disable, isolate, revoke, block
EradicateRemove attacker access and persistenceAsset inventory, golden images, credential rotation paths
RecoverRestore service safelyTested backups, deploy-from-clean pipeline, monitoring for return
LearnStop the class recurringBlameless review template, action tracking
FigResponse actions push back to the endpoint
CYART // SCHEMA · EDR-TELEMETRY7 NODES · 7 LINKSEVENTSVERDICTCOMMANDACTOR · Endpoints — 50k agents, 1 kB/s eachACTOR01Endpoints50k agents, 1 kB/s eachEDGE · Ingest gateway — mTLS, per-agent tokenEDGE02Ingest gatewaymTLS, per-agent tokenSTREAM · Buffer — Kafka, 72 h retentionSTREAM03BufferKafka, 72 h retentionSERVICE · Real-time rules — Sigma, 1 s budgetSERVICE04Real-time rulesSigma, 1 s budgetSERVICE · Batch analytics — hunting, baselinesSERVICE05Batch analyticshunting, baselinesEDGE · Response — isolate host, kill procEDGE06Responseisolate host, kill procDATA · Data lake — Parquet, 1 yDATA07Data lakeParquet, 1 y
  • ACTOR
  • EDGE
  • SERVICE
  • DATA
  • STREAM
  • Live flow
  • Lookup / async
//Real-time rules reach a verdict within a second of the event arriving. High-confidence verdicts can isolate a host or kill a process automatically; the command path back to the agent is authenticated and logged like any other privileged action.

This is an advanced module

Detection & Response Engineering is part of the Pro pass. 6 more sections — the deep dives, the final design, follow-ups and the test — unlock with it.

Enter access codeSee Pro pass

Already a cyart.io or studio.cyart.io member? Your pass code is in your Studio account.

Related lessons