IR — Incident Response
Concept
Incident Response (IR) is the process a security team follows after a potential threat is detected: understanding what happened, deciding what to do, taking action, and recording the outcome.
Detection alone does not stop an attack. The value of a detection depends on how quickly and confidently the team can act on it. In SentriaOne xSIEM, Incident Response focuses on making that follow-up easier.
From detection to action
1. Detection
A detection is raised by SIEM or NDR analysis.
2. Review the detection details
The detection details give the security team the context needed to understand the threat without searching through raw data manually:
| Detail | How it helps |
|---|---|
| Description | Explains what was detected and why it matters |
| Activity flow | Shows how the activity progressed — which systems were involved and in what sequence |
| Affected assets | Identifies the hosts, users, or services involved |
| Supporting context | Related events, MITRE ATT&CK mapping, and threat intelligence matches |
| Recommendations | Suggested follow-up steps for handling the detection |
3. Decide
The security team uses the detection details and recommendations to decide the real action to take. The recommendation supports the decision; the security team remains responsible for choosing the action that fits the organization's policy, business impact, and risk.
Typical questions at this step:
- Is this a true threat or a false positive?
- How severe is it, and which assets are at risk?
- Does it need immediate containment, or further investigation?
- Who else must be involved?
4. Act
Common categories of response actions include:
| Action category | Examples |
|---|---|
| Contain | Isolate an affected host, block a malicious address, disable an account |
| Investigate | Search related activity, perform threat hunting across the environment |
| Remediate | Remove malware, patch a vulnerability, reset credentials |
| Escalate | Notify system owners, management, or external parties |
SentriaOne xSIEM supports integrated response with other security tools, so actions can be coordinated with the tools already deployed in the environment.
5. Record the case
Case management keeps the full record of an incident: the detection, the evidence reviewed, decisions made, actions taken, and the final outcome. A complete case record supports handover between analysts, reporting, compliance, and lessons learned.
Incident Response in SentriaOne xSIEM
| Capability | Description |
|---|---|
| Complete case management | Detections are handled and tracked as cases through to closure |
| Integrated response with security tools | Response is coordinated with other security tools in the environment |
| Detection details and recommendations | Context, activity flow, and recommendations support faster decisions |
Incident Response in the dashboard
Each step maps to a feature of the SentriaOne xSIEM dashboard.
| Step | Dashboard feature |
|---|---|
| Detection | Security Overview and Detections |
| Review the detection details | Detection Details: What Happened, What Triggered, Risk Signals |
| Activity flow and evidence | Records between asset and peer, and Participant & History (other detections of the same host or peer) |
| Recommendations | MITRE ATT&CK panel — techniques and recommended mitigations |
| Record the case | Detection Tracking — status, assignee, and notes |
For complete examples, see How to analyze a detection and How to analyze top affected internal IPs.
Strategic, not only tactical
A tactical response handles a single alert. A strategic response also asks why the incident was possible and how to prevent it from happening again. By combining detection context from logs and network traffic in one platform, SentriaOne xSIEM helps teams move from handling individual alerts toward improving their overall security posture.