Analysis Paralysis? Setting the Right Goal for Your Incident Analysis

SANS DFIR Summit 2022

Speaker: Gerard Johansen

Properly analyzing an incident is paramount in gaining situational awareness to properly contain a threat. Further, a comprehensive analysis may also tell you how an attacker was able to gain access to the environment. The challenge is matching the right analysis methods to the goals an analyst needs to achieve. What is needed is an understanding of the various incident analysis levels and what they can tell us. During the course of the …

analysis incident