Who is Who During a Cyber Incident Response Investigation
summary
Covers techniques for identifying individuals involved during a cyber incident response investigation, focusing on mapping user identities, devices, and activity across enterprise systems. Describes using log sources, endpoint data, network telemetry, and identity management (e.g., Active Directory) to correlate artifacts and attribute actions to specific people.
AI-written summary · about
chapters (5)
- 0:00Start
- 0:45Audience and Scope
- 2:20Cyber Incident Response (IR) teams role
- 4:21End users role
- 7:09Next steps
related talks
54mSOCcing: Responding to a Cyber Incident
20mThe Art of Attribution: Identifying and Pursuing your Cyber Adversaries
51mReal World Stories of Incident Response and Threat Intelligence
25mPlays Incident Response
40mIncident Response – How to Give the Advantage to the Hackers!
18mSurviving the Attack: Planning and Practicing IoT Security Response
55mThe State of Incident Response
07mThe True Story of a Cyber-Takedown