Detect and Respond: from the first signal to restored operations

Three of the six: Detect (DE), whose outcome is “Possible cybersecurity attacks and compromises are found and analyzed”; Respond (RS), whose outcome is “Actions regarding a detected cybersecurity incident are taken”; and Recover (RC), whose outcome is “Assets and operations affected by a cybersecurity incident are restored.” Detect has two categories, Continuous Monitoring (DE.CM) and Adverse Event Analysis (DE.AE); Respond has four, Incident Management (RS.MA), Incident Analysis (RS.AN), Incident Response Reporting and Communication (RS.CO) and Incident Mitigation (RS.MI); Recover has two, Incident Recovery Plan Execution (RC.RP) and Incident Recovery Communication (RC.CO) (NIST CSF 2.0).

Ransomware is malware that encrypts an organization’s files and systems and demands payment to restore access; attackers often also steal the data and threaten to sell or publish it if the ransom is not paid (NIST IR 8374; CISA). The SOC looks for the signs of compromise that precede the impact, such as suspicious behavior and lateral movement, and coordinates the response, with playbooks that automate triage, enrichment and containment. At Vortex, the Cyber Defense Center, the NG-SOC Convergente, acts from initial triage to response; the incident response and digital forensics (DFIR) retainer contains, investigates and eradicates the attack; and business continuity and disaster recovery (BCDR) planning prepares recovery.

SIEM (Security Information and Event Management) is the platform that centralizes the logs and security events of the entire environment, such as firewalls, servers, identities, cloud and applications, correlates those events and generates alerts; it also stores the logs for investigation and auditing (NIST). Without a SOC, the SIEM generates alerts that nobody investigates. In the Vortex SIEM-as-a-Service, the platform is hosted and fully operated by Vortex, and the company consumes the service by sending its logs.

Each one covers a part of detection and response. SIEM centralizes and correlates the logs of the entire environment and generates the alerts. SOAR runs playbooks that automate triage, enrichment, containment and response. EDR detects and responds on workstations and servers. NDR analyzes network traffic and finds lateral movement, command and control and exfiltration, including on equipment that cannot take an agent. XDR correlates endpoint, network, identity, cloud and email in a single platform. None of them replaces the operation that investigates and decides: the SOC. The guide to SIEM, SOAR, EDR, XDR and NDR (PT) compares the five in a table.

It is information about cyber threats that has been aggregated, analyzed and enriched to provide context for decisions (NIST SP 800-61r3): indicators of compromise, attacker tactics and techniques and monitoring of the deep and dark web for leaked credentials, data leaks and phishing campaigns against the company. In NIST CSF 2.0, threat intelligence is part of event analysis (DE.AE-07). At Vortex, it enriches the alerts of the Cyber Defense Center and guides detection.

It is the proactive search, carried out by analysts, for signs of attack that rules and use cases do not yet detect, over the telemetry already collected. It goes hand in hand with detection engineering, which creates and tunes rules based on what is learned. In the Cyber Defense Center, proactive threat hunting on the collected telemetry and continuous detection engineering, aligned with MITRE ATT&CK, are part of the service.

It is the tactic in which the attacker, already inside the environment, moves from one system or account to others until reaching the target, often with legitimate credentials and native tools, which makes it stealthy (MITRE ATT&CK, TA0008). In the Detect and Respond phase, three technologies help to see it: NDR, which analyzes network traffic; deception technology, with honeypots and honeytokens in which any interaction is suspicious; and ITDR, which detects compromised accounts, privilege escalation and lateral movement via identity in AD and Entra ID.

The plan defines, before an attack, how the company detects, contains, eradicates and recovers from an incident: who leads and decides, how the incident is classified, who is notified and when, which playbooks to follow, how to preserve evidence and how to restore systems (NIST). For NIST, it needs to be maintained, tested and synchronized with the business continuity plan (NIST SP 800-61r3). The incident response plan guide (PT) details each part, with the ransomware case and notification to the ANPD, Brazil’s data protection authority.

The incident response plan puts the company’s response capability into practice: roles, classification, communication, playbooks, evidence, recovery and lessons learned. The business continuity and disaster recovery plan reduces disruption to operations in serious situations, not only attacks, based on business impact analysis (BIA) and risk assessment. The two need to work together. At Vortex, business continuity and disaster recovery (BCDR) planning includes the BIA, recovery strategies and testing.

DFIR (Digital Forensics and Incident Response) is the combination of incident response, which contains, investigates and eradicates the attack, with digital forensics, which preserves and analyzes the evidence to reconstruct what happened. In the Vortex incident response retainer, the response and forensics team is available under contract before the incident happens, to contain, investigate and eradicate attacks quickly.

It includes the planning. BCDR prepares business continuity and disaster recovery, with business impact analysis (BIA), recovery strategies and testing. Backup and restore are not part of the Vortex catalog. In NIST CSF 2.0, recovery begins when the response process initiates it and ends when normal operating status is confirmed and the end of recovery is declared and documented (RC.RP-01, RC.RP-05 and RC.RP-06).

The company, as the data controller. When the incident affects personal data and may cause relevant risk or harm to the data subjects, Brazil’s LGPD (General Data Protection Law) requires notifying the ANPD and the data subjects within three business days, under Resolução CD/ANPD nº 15/2024. The DFIR investigation and digital forensics help establish what happened and what was affected. The incident response plan guide (PT) shows the flow.

OT-Threat Detection monitors industrial protocols, networks and devices in real time and detects atypical behavior and signs of attack. In the Cyber Defense Center, IT and OT are monitored on the same platform, and correlation shows when an attack that started in the office reaches the plant; the response is coordinated in a war room with IT and with the plant team.