Incident_Response_Guide.pdf

About this guide Terms and definitions Incident Response Basics Attack lifecycle (kill chain) Incident response steps Recommended IR process and rules Preparation Identification Incident triggers Prioritization guidelines Analyzing incidents in SIEM Containment Eradication Recovery Lessons learned Incident response example The attack plan The incident response Preparation (example) Identification (example) Containment (example) Eradication and Recovery (example) Lessons learned (example) Recommended tools and utilities Tools for collecting IOC Sysinternals utilities Tools for creating dumps GRR Rapid Response Forensic Toolkit dd utility Belkasoft RAM Capturer Tools for analysis Kaspersky Threat Intelligence Portal Tools for analyzing memory dumps Tools for analyzing hard disk dumps Strings utility Tools for eradication Kaspersky Virus Removal Tool Kaspersky Rescue Disk AO Kaspersky Lab Trademark notices