DEFINITION 01
Chain of Custody
Chain of custody is the documented history of who collected, held, transferred, and examined an item of digital evidence.
The CyberGuard field guide / Topics
Incident Response.
Follow the language of detecting, containing, investigating, and recovering from incidents.
15 published definitionsPractical examples and source links
← Back to the dictionary
THE DEFINITIONS
Explore Incident Response.
Open a term for a plain-language explanation, a technical explanation, and a practical example.
DEFINITION 02
Detection Engineering
Detection engineering is the design, testing, and maintenance of logic that identifies meaningful signs of suspicious activity in security data.
DEFINITION 03
Eradication
Eradication is the response work that removes the cause and remaining footholds of an incident after immediate harm has been contained.
DEFINITION 04
Evidence Preservation
Evidence preservation is the protection of relevant records, devices, and data from alteration or loss during a security investigation.
DEFINITION 05
Forensic Imaging
Forensic imaging is the controlled copying of a storage device or data source for analysis while retaining an identifiable original and documenting integrity.
DEFINITION 06
Incident Containment
Incident containment is the set of actions taken to limit the spread and immediate impact of a security incident while preserving a path to investigate and recover.
DEFINITION 07
Incident Response
Coordinated actions to prepare for, detect, contain, eradicate, and recover from a cybersecurity incident.
DEFINITION 08
Incident Severity
Incident severity is a ranking of the actual or potential impact of a security incident used to guide urgency, escalation, and response resources.
DEFINITION 09
Log Retention
Log retention is the policy and practice of keeping event records for a defined period so they remain available for operations, investigations, and obligations.
DEFINITION 10
Playbook
A security playbook is a documented set of steps, decision points, and responsibilities for handling a recurring security scenario.
DEFINITION 11
Root Cause Analysis
Root cause analysis is the structured effort to identify the conditions that allowed an incident to occur and to prevent similar failures.
DEFINITION 12
Security Information and Event Management
A system that collects and analyzes security events from multiple sources.
DEFINITION 13
Security Operations Center
A security operations center is a team and working function that monitors security signals, investigates alerts, and coordinates response to suspected incidents.
DEFINITION 14
Security Orchestration Automation and Response
Security orchestration, automation, and response connects security tools and repeatable workflows to help teams triage alerts and carry out approved response steps.
DEFINITION 15
Tabletop Exercise
A tabletop exercise is a guided discussion of a simulated incident in which participants walk through decisions, roles, and communications without disrupting live systems.
KEEP EXPLORING
Follow another topic.
Build context across the connected parts of cybersecurity.
Browse all other topics
Network Security 22Malware 18Web Application Security 17AI Security 15Business Cybersecurity 15Cloud Security 14Core Cybersecurity 6Cryptography 4Identity Access 4Phishing Social Engineering 4Vulnerability Management 4Fraud Online Safety 3Privacy Data Protection 2Security Technologies 2Threat Intelligence 2Endpoint Security 1Ethical Hacking 1Governance Risk Compliance 1Wireless Mobile Security 1