RS.AN-03 Root cause analysis
Analyzing what happened during an incident and why: the sequence of events, assets involved, vulnerabilities and threat actors, systemic root causes and evidence from deception technology.
RS.AN Incident analysis
Incident Analysis: root cause analysis, recording investigation actions, preserving incident data and estimating incident magnitude; four Subcategories.
RS.AN-06 Investigation actions recorded
Recording the actions taken during an investigation and preserving the integrity and provenance of those records, with immutable responder logs and a detailed record kept by the incident lead.
RS.AN-07 Incident data collected and preserved
Collecting incident data and metadata and preserving their integrity and provenance under evidence preservation and chain-of-custody procedures.
RS.AN-08 Incident magnitude estimated
Estimating and validating an incident's magnitude by searching other potential targets for indicators of compromise and persistence, manually or with automated tools.
