An analyst is becoming overwhelmed with the number of events that need to be investigated for a timeline. Which of the following should the analyst…

During an incident investigation, an analyst is often faced with a massive volume of event data. To effectively manage this and "move the incident forward," the analyst must prioritize. Focusing on the impact of the events is the most critical prioritization factor. Impact assessment helps determine the severity of the incident, the scope of the compromise, and the potential damage to the organization. By prioritizing events that indicate a higher impact (e.g., data exfiltration, privilege escalation on a critical server), the analyst can focus on the most significant threats first, leading to a more efficient and effective response.

B. Vulnerability score: This is a pre-incident metric that quantifies potential weaknesses; it does not help in prioritizing events that have already occurred during an active incident.

C. Mean time to detect: This is a key performance indicator (KPI) used to measure the overall effectiveness of a security program, not a criterion for prioritizing evidence within a specific investigation.

D. Isolation: This is a containment strategy or response action. It is a step taken after an investigation has provided enough evidence to justify it, not a factor used to prioritize the analysis of events.

1. NIST Special Publication 800-61 Rev. 2

Computer Security Incident Handling Guide. Section 3.2.3

"Incident Prioritization

" states that prioritization is critical and is generally based on factors like functional impact (e.g.

services are down) and informational impact (e.g.

data was exfiltrated). This directly supports focusing on impact to guide the investigation.

2. Carnegie Mellon University

Software Engineering Institute

Defining the Process for Handling Computer Security Incidents. In the document's discussion of the Triage phase (CMU/SEI-99-TR-020

Section 3.1)

the process involves assessing the incident's priority based on its "technical severity and the business impact

" which aligns with focusing on the overall impact to move the investigation forward.