In this article, we will cover Security Incident Triage, how to combine local and global threat intelligence for effective triage.
When analyzing and categorizing information security incidents it is important to think about how the hacker. With regard to prevention, we cannot assume exactly which path a hacker will take to access the data network, however, each attack works through a certain standard, which according to Lockheed Martim is called a "cyber kill chain."

The "cyber kill chain" is a sequence of stages necessary for a hacker to enter and obtain data from a network, and each stage reveals a specific goal along the way. Designing the monitoring and response plan around the cyber destruction chain model is an effective method as it focuses on current scenarios and attack vectors.

This approach of thinking like the potential Hacker can be summarized in 4 steps:
1 - Attacker’s Goal - Reconnaissance and Scan: Find the target and develop an attack plan based on opportunities for exploration.
2 - Delivery & Attack - Bring the delivery engine online and use social engineering to induce the target to access malware or other exploitation.
3 - Exploitation & Installation - Exploit vulnerabilities on target systems to acquire access, escalate user privileges, and install the payload.
4 - System Compromise – Ex-filter data of high value without noise and as soon as possible. Use the compromised system to gain additional access, "steal" computing resources, and/or use it as an attack against other assets.

WHAT SECURITY EVENTS SHOULD YOUR ORGANIZATION BE CONCERNED ABOUT?
To help categorize each type of incident, you can align the types of events into the Cyber Kill Chain to determine the appropriate priority and incident response strategy.
The table below shows how it can be done:

Incident Type	Cyber Kill Chain Stage	Priority Level	Recommendations
Port Scanning Activity (pre‑incident)	Reconnaissance & Probing	Low	Ignore most events, except when the source IP has a malicious reputation and that there are multiple events of that same IP a short time interval.
Malware Infection	Delivery & Attack	Low-Medium	Fix any malware infection as soon as possible before they progress. Scan the network to look for indicators of compromise associated with stand event (e.g. MD5 hashes).
Distributed Denial of Service	Exploitation & Installation	High	Configure servers exposed on the web to protect against requests of extreme requests by HTTP and SYN. Coordinate with your ISP during an attack to block the source IPs.
Unauthorized Access	Exploitation & Installation	Medium	Detect, monitor, and investigate how non-authorized access attempts are prioritized for that they are essential and/or contain sensitive data..
Insider Breach	System Compromise	High	Identify privileged users for all domains, servers, applications, and critical devices. Make sure that monitoring is enabled for all systems and for all system events, and make sure that you are feeding your monitoring infrastructure (SIEM).

COMBINE LOCAL AND GLOBAL THREAT INTELLIGENCE FOR EFFECTIVE SECURITY INCIDENT TRIAGE
We often think of the incident response as detailed and meticulous forensic work, closely observing one system at a time. However, the vast majority of security monitoring work can be addressed through a larger, more holistic view of the state and activity in your infrastructure.
Cyber Threat Intelligence allows you to move away from the focus on vulnerabilities, exploits, and patches and focus on elements that are actively damaging the confidentiality, integrity, and availability of your organization's data. The first step is to understand as much as possible about your current environment. Some experts refer to this as environmental, situational, or contextual awareness.

*At Hardsecure the approach refers to threat intelligence against the scenario under analysis.
After combining valuable information about your own network with the latest global threat intelligence (details about hacker tools, techniques, and trends), your organization can achieve predictive screening effectively. To meet this approach Hardsecure has a dedicated team - Intelligence and Security Analysis Team (ISAT).
To learn more about Hardsecure's Cyber Threat Intelligence services please contact us.