What is the difference between the four-phase and six-phase incident response models?

They describe the same workflow with different groupings. NIST SP 800-61 uses four phases (Preparation; Detection & Analysis; Containment, Eradication & Recovery; Post-Incident Activity), while the common six-phase model uses Preparation, Identification, Containment, Eradication, Recovery, and Lessons Learned. The six-phase version simply breaks the combined NIST middle phase into separate steps, so teams map one onto the other freely.

What do SIEM, EDR, and SOAR each do?

A SIEM aggregates and correlates logs from across the environment and raises alerts. EDR (or XDR) runs on endpoints to detect malicious behavior and enable remote response such as isolating a host. SOAR automates repetitive response workflows through playbooks, reducing manual effort and speeding up containment. Together they form the core of a modern SOC.

What are MTTD and MTTR, and why do they matter?

MTTD (Mean Time to Detect) measures how long it takes to discover a compromise, and MTTR (Mean Time to Respond) measures how long from detection to containment or resolution. Both are key SOC performance metrics — reducing them shrinks the attacker window of opportunity and directly limits the damage an incident can cause.

What is MITRE ATT&CK used for in detection?

MITRE ATT&CK is a knowledge base of real-world adversary tactics and techniques. SOCs map their detections to it to reason about attacker behavior rather than relying only on static indicators, and to measure how much of the adversary playbook their monitoring actually covers.

Why is incident response different for OT/ICS environments?

In OT/ICS environments, safety and physical-process availability take priority over the data-centric goals of IT. You often cannot simply isolate or power off a device, because doing so could damage equipment or endanger people. Effective OT response requires close coordination with control engineers, OT-aware monitoring tools, and careful handling of fragile legacy systems.

Engineering·10 min read·June 17, 2026

🚨 Incident Response and the SOC: Detecting, Containing, and Recovering from Cyber Attacks

A practical, vendor-neutral guide to incident response and the modern Security Operations Center — covering the four-phase and six-phase IR lifecycles, SOC roles and tooling (SIEM, EDR/XDR, SOAR), detection with MITRE ATT&CK and IOCs, containment and recovery, and the special demands of OT/ICS environments.

📖Industrial Cybersecurity Reference (Full Access)

View →

What Is Incident Response?

Incident response (IR) is the organized process an organization follows to detect, contain, and recover from a cybersecurity event that threatens the confidentiality, integrity, or availability of its systems and data. An event is any observable occurrence; an incident is an event (or series of events) that actually harms — or imminently threatens to harm — the business.

Why does a written plan matter? When ransomware is encrypting file servers at 3 a.m., nobody has time to invent a process. A tested incident response plan (IRP) defines who does what, who decides, who to call (legal, regulators, insurers, law enforcement), and how to communicate — before the pressure is on. Improvised response wastes the most valuable resource during an attack: time.<

Topics covered

incident responsesecurity operations centerNIST SP 800-61incident response lifecycleMITRE ATT&CKSIEM EDR SOAROT ICS incident responsemean time to detect MTTD MTTR