A. To understand current posture
B. To understand desired outcomes
C. To understand customer's process
D. To understand required tools
A. Incident
B. Ticket
C. Alert
D. Event
E. Log
A. Fast Eradication
B. Post-Incident Review
C. Incident Containment
D. Incident Analysis
A. Block from Sharing
B. Escalation Level
C. Enrichment whitelist/blacklist
D. IoC Type
E. Severity
F. Cyber Kill Chain Step
G. Traffic Light Protocol
A. Who reported the phishing attempt
B. State of the phishing email
C. IP addresses from the header
D. Hashes and/or file names found in the EML attachment
E. Type of Ingestion Rule used to identify this email as a phishing attempt
F. URLs, domains, or IP addresses appearing in the body
A. Problem Managers
B. Analysts
C. Vulnerability Managers
D. Chief Information Security Officer (CISO)
