Key Terms and Stakeholders in Incident Response

An Indicator of Compromise is evidence, extracted from a system or network, that points to a breach. The concept originates in host and network forensics: investigators examining a compromised machine identify artefacts that distinguish malicious activity from normal operation. Those artefacts are then codified as IOCs and shared, allowing other defenders to search their own environments for the same markers.

IOCs are shared via structured formats. STIX (Structured Threat Information Expression) and TAXII (Trusted Automated Exchange of Intelligence Information) are the dominant open standards. Commercial threat intelligence platforms aggregate IOC feeds from multiple sources, apply confidence scoring, and push indicators to SIEM rules and endpoint detection tools automatically.

The MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) framework is a publicly maintained knowledge base of adversary behaviour, built from real-world observations of cyber intrusions. It organises TTPs across 14 tactic categories for enterprise environments: Reconnaissance, Resource Development, Initial Access, Execution, Persistence, Privilege Escalation, Defence Evasion, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration, and Impact.

Each technique has a unique identifier (for example, T1566 for Phishing), sub-techniques for variants (T1566.001 for Spearphishing Attachment), and documented mitigations and detections. An incident responder who identifies a technique in the ATT&CK matrix can immediately consult associated detection opportunities and mitigation controls. This is the practical value of the framework: it translates an observed attacker action into a structured search for evidence and a set of concrete defensive steps.

Procedures are the specific implementation of a technique by a particular actor or campaign. Two groups may both use T1003 (OS Credential Dumping), but one uses Mimikatz run from a command shell and the other uses a custom-compiled tool loaded via reflective DLL injection. The procedure-level detail matters for attribution and for understanding the full scope of a compromise: knowing which specific procedure was used tells the responder where to look for artefacts and what additional techniques the actor is likely to follow with.

A threat actor is the individual or group behind a malicious act. Classifying the actor is not academic: it shapes the response, the evidence strategy, and the notification obligations. A ransomware group encrypts data for financial gain and typically announces itself; a nation-state actor conducting espionage may be present for months without leaving obvious signs. The response timeline, the forensic depth required, and the legal obligations differ substantially between the two.

Advanced Persistent Threat (APT) is a specific term for a sophisticated, state-sponsored or state-linked actor who gains long-term access and maintains it stealthily. The term is sometimes misused as a synonym for any sophisticated attack; the key distinguishing features are the persistence (dwell times measured in months or years) and the stealth (covering tracks, blending into legitimate traffic, using legitimate tools).

A CSIRT is the team formally responsible for managing a confirmed security incident from containment through recovery. Its composition varies by organisation size, but the core functional roles are consistent. The CSIRT lead coordinates the response, assigns tasks, manages communications to leadership, and makes containment decisions. The forensic analyst collects and analyses evidence from affected systems. The threat intelligence analyst contextualises the attack using IOC feeds and TTP databases. The communications liaison is the interface to non-technical stakeholders: legal counsel, executives, regulators, and the public.

The escalation path defines when and how an incident moves up the chain of authority. A common three-tier structure works as follows. Tier 1 covers the SOC analyst who triages alerts and confirms whether an event is a genuine incident. Tier 2 covers the CSIRT, activated when a confirmed incident is scoped and containment decisions are needed. Tier 3 covers executive leadership, legal counsel, and board notification, triggered when the incident involves regulated data, financial impact above a defined threshold, or reputational risk to the organisation.

National CSIRTs operate at the sector or country level. CERT-In (Indian Computer Emergency Response Team) is India's national nodal agency under the Ministry of Electronics and Information Technology, with mandatory six-hour reporting requirements for specified incident types under the Information Technology Act 2000 and associated directions. In the EU, national CSIRTs operate under the NIS2 Directive framework. CISA (Cybersecurity and Infrastructure Security Agency) coordinates response for US critical infrastructure. These bodies provide threat intelligence sharing, technical assistance, and coordination across organisations in a sector-wide incident.

A serious incident activates stakeholders well beyond the technical response team. The following groups and their primary responsibilities form the complete map.

Legal counsel plays a role that is often underappreciated in technical circles. They determine whether attorney-client privilege applies to forensic reports, which affects whether those reports can be compelled in litigation. They advise on notification deadlines: the UK ICO requires notification within 72 hours under UK GDPR; the EU's NIS2 Directive requires an early warning within 24 hours; India's DPDPA 2023 requires notification of the Data Protection Board and affected data principals without delay; US state breach notification laws set timelines ranging from 30 to 90 days depending on jurisdiction. Missing a deadline is a separate regulatory violation from the incident itself.

The real test of shared vocabulary is whether it survives contact with a real incident. Consider a scenario: a SOC analyst notices an unusual outbound DNS query from a server in the finance segment. The domain resolves to an IP address flagged in two threat intelligence feeds as a known command-and-control (C2) address for a financially motivated criminal group. The analyst has identified an IOC (the flagged domain and IP), a possible threat actor category (organised crime), and a probable tactic (command and control, ATT&CK TA0011).

The analyst escalates to the CSIRT lead using a structured notification: the incident type (suspected C2 communication), the affected asset (finance segment server), the IOC (domain and IP with source references), and the confidence level (medium, two independent feeds). The CSIRT lead can now make a containment decision, brief the CISO using the same vocabulary, and instruct the forensic analyst on what evidence to preserve. If the server holds personal data, legal counsel receives a parallel briefing and starts the clock on notification deadlines.

The same vocabulary also anchors the post-incident review. The after-action report will describe the threat actor category, the TTPs observed (mapped to ATT&CK identifiers), the IOCs that were and were not detected, the escalation path taken, and the points where communication failed or was delayed. That structured record feeds into updated playbooks, detection rules, and stakeholder briefing templates for future incidents. For further detail on building the team that executes this vocabulary, see Building a Computer Security Incident Response Team.