In this scenario, you'll learn the critical distinction between the phases of the EC-Council Incident Handling and Response (IH&R) framework. You will identify exactly when an analyst determines if a fired alert is a legitimate threat or just noise.
Scenario Context
You are managing the SOC shift at PNP Infosystems Inc. An automated alert has just fired from your AWS WAF indicating a potential SQL Injection attack against your core payment API.
The SOAR platform automatically generates a ServiceNow incident ticket and assigns it to an incident handler named Mike. Before escalating the issue to the IR lead or mobilizing a containment strategy, Mike must first verify the telemetry.
Security Environment
Mike reviews the initial alert details populated in the SIEM and the ticketing system to perform his validation:
[ServiceNow] Time: 14:02:11 | Event: TICKET_CREATED | ID: INC-8441 | Sev: High | Title: WAF SQLi Detected
[ServiceNow] Time: 14:02:15 | Event: TICKET_ASSIGNED | Assignee: Mike (L2 Analyst)
[Splunk] index=waf sourcetype=aws:waf src_ip=10.0.5.55 uri="/api/v1/users?id=1' OR '1'='1" action=blocked
[Splunk] index=asset_inventory ip=10.0.5.55 owner="DevSecOps_Scanner" environment="Internal_VLAN"
Mike's Analysis Notes: "Payload detected is a standard SQLi test string. Source IP maps back to our internal Tenable Nessus scanner running its weekly scheduled scan. WAF correctly blocked the request. No successful exploitation occurred. Marking as False Positive / Authorized Scanning Activity."
Question
Mike is an incident handler for PNP Infosystems Inc. One day, there was a ticket raised regarding a critical incident and Mike was assigned to handle the incident. During the process of incident handling, at one stage, he has performed incident analysis and validation to check whether the incident is a true incident or a false positive. Identify the stage in which he is currently in.
SOC Hint: You might be tempted to pick "Triage," but in the EC-Council IH&R methodology, the initial step where the ticket is opened and the analyst asks "Is this real or a false positive?" happens *before* triage.
Expert Insight
1. What is Happening
Mike has received an alert for a high-severity event. However, seasoned analysts know that a significant percentage of SIEM alerts are false positives caused by authorized vulnerability scanners, misconfigured applications, or poorly tuned rules. Before he sounds the alarm, he is validating the alert telemetry against internal threat intelligence (the asset inventory) to confirm it is not a true threat.
2. Why the Correct Answer is Correct
B is correct. According to the EC-Council Incident Handling and Response (IH&R) process, the "Incident Recording and Assignment" phase involves logging the incident details into a ticketing system, assigning personnel, and crucially, performing initial validation to determine if the event is a true incident or a false positive. If it's a false positive, the process ends here.
3. Why Other Options are Wrong
Understanding the exact boundaries of the IH&R framework is critical for the exam and SOC operations:
C (Incident Triage): This is the most common distractor. In the EC-Council framework, "Triage" occurs after validation. Triage is about prioritizing the incident, categorizing its severity, and assigning resources based on the business impact of a confirmed true positive.
A (Post-Incident Activities): This happens at the very end of the lifecycle (lessons learned, updating playbooks, evidence retention), long after validation.
D (Incident Disclosure): This involves notifying external stakeholders (legal, PR, law enforcement, affected customers) and only happens for validated, significant incidents.
4. Real-World SOC Application
In a modern SOC, the "Recording and Assignment" phase is heavily automated. A SOAR (Security Orchestration, Automation, and Response) platform typically ingests the alert, creates the Jira/ServiceNow ticket, and can even automatically query the asset database. However, the human L1/L2 analyst is still usually responsible for the final validation (True Positive vs. False Positive) decision before escalating it to an Incident Commander for Triage and Containment.
MINI LESSON: The True vs. False Positive Workflow
When you get assigned a new ticket, follow this rapid validation pattern before declaring an incident:
Contextualize the Source: Is the source IP internal or external? Is it a known scanner (Nessus, Qualys, internal Red Team)?
Analyze the Payload: Is the attack string generic (like a scanner testing ' OR 1=1) or highly targeted to your specific application framework?
Check the Result: Did the security control (WAF/EDR) block it, or did the server return an HTTP 200/500 indicating potential execution?
Make the Call: If Source = Authorized Scanner AND Result = Blocked, document the findings and close the ticket as a False Positive (or Authorized Activity) in the Recording phase.
Sharpen your SIEM analysis and prepare for the CSA exam.