[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:nist-csf\u002Frs-an":3},{"item":4,"lessons":16,"controls":67,"related":96},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"nist-csf","rs-an","RS.AN-1","Incident Analysis",39,"US National Institute of Standards and Technology (NIST)","**What it asks for.** This Respond category, called Analysis in CSF 1.1, asks that investigations are conducted to ensure effective response and support forensics and recovery. It covers determining what happened and the root cause, preserving evidence and estimating incident magnitude.\n\n**In practice.** Responders follow playbooks to scope incidents, collect and preserve evidence with integrity, build timelines and identify root cause. Forensic capability exists in house or via a retainer, and incidents are categorised consistently. Evidence includes investigation records, chain of custody documentation and root cause reports.\n\n**Common gaps.** Evidence is often lost because logs were not retained or systems were rebuilt too early. Root cause analysis is frequently skipped once service is restored, so the same weakness can be exploited again.",null,"https:\u002F\u002Fwww.nist.gov\u002Fcyberframework","Open the Cybersecurity Framework at NIST","2026-10-18T15:18:43.663+00:00",{"total":17,"list":18},50,[19,23,27,31,35,39,43,47,51,55,59,63],{"slug":20,"title":21,"published_at":22},"actively-exploited-check-point-and-unrealircd-flaws-highlight-urgency-of-timely-patching","Actively Exploited Check Point and UnrealIRCd Flaws Highlight Urgency of Timely Patching","2026-11-14T10:20:44.573+00:00",{"slug":24,"title":25,"published_at":26},"record-uk-cyber-incident-reports-highlight-data-extortion-surge","Record UK Cyber Incident Reports Highlight Data Extortion Surge","2026-11-13T13:23:12.232+00:00",{"slug":28,"title":29,"published_at":30},"check-point-zero-day-exploited-for-root-access-via-ipc-interface-flaw","Check Point Zero-Day Exploited for Root Access via IPC Interface Flaw","2026-11-13T11:20:59.093+00:00",{"slug":32,"title":33,"published_at":34},"ai-powered-tools-aim-to-close-the-gap-between-vulnerability-discovery-and-remediation","AI-Powered Tools Aim to Close the Gap Between Vulnerability Discovery and Remediation","2026-11-13T10:21:46.443+00:00",{"slug":36,"title":37,"published_at":38},"unpatched-check-point-gateways-weaponized-for-destructive-wiper-attacks","Unpatched Check Point Gateways Weaponized for Destructive Wiper Attacks","2026-11-13T08:20:43.007+00:00",{"slug":40,"title":41,"published_at":42},"ai-accelerated-attacks-are-outpacing-human-speed-soc-defenses","AI-Accelerated Attacks Are Outpacing Human-Speed SOC Defenses","2026-11-12T17:22:09.493+00:00",{"slug":44,"title":45,"published_at":46},"qilin-raas-admin-unmasked-through-reused-digital-identities","Qilin RaaS Admin Unmasked Through Reused Digital Identities","2026-11-12T14:21:18.908+00:00",{"slug":48,"title":49,"published_at":50},"actively-exploited-outlook-flaw-exposes-ntlmv2-hashes-patch-immediately","Actively Exploited Outlook Flaw Exposes NTLMv2 Hashes — Patch Immediately","2026-11-11T09:20:58.929+00:00",{"slug":52,"title":53,"published_at":54},"unpatched-openssh-flaw-lets-attackers-bypass-linux-password-authentication","Unpatched OpenSSH Flaw Lets Attackers Bypass Linux Password Authentication","2026-11-11T08:20:44.267+00:00",{"slug":56,"title":57,"published_at":58},"chained-barracuda-flaws-exploited-in-the-wild-before-widespread-patching","Chained Barracuda Flaws Exploited in the Wild Before Widespread Patching","2026-11-11T08:20:26.939+00:00",{"slug":60,"title":61,"published_at":62},"ai-powered-sandbox-analysis-accelerates-soc-response-to-sophisticated-phishing-campaigns","AI-Powered Sandbox Analysis Accelerates SOC Response to Sophisticated Phishing Campaigns","2026-11-10T16:20:41.09+00:00",{"slug":64,"title":65,"published_at":66},"ai-assisted-bank-breaches-and-poem-guided-malware-highlight-evolving-c2-evasion-tactics","AI-Assisted Bank Breaches and Poem-Guided Malware Highlight Evolving C2 Evasion Tactics","2026-10-09T14:21:32.64+00:00",[68,73,78,82,87,92],{"slug":69,"name":70,"problem":71,"stories":72},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",19,{"slug":74,"name":75,"problem":76,"stories":77},"patch-management","Automated patch management","Known holes get closed in days, not months.",11,{"slug":79,"name":80,"problem":81,"stories":77},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",{"slug":83,"name":84,"problem":85,"stories":86},"threat-intelligence","Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",10,{"slug":88,"name":89,"problem":90,"stories":91},"managed-detection-response","Managed detection and response (MDR)","A team watches and responds around the clock when you cannot.",7,{"slug":93,"name":94,"problem":95,"stories":91},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",[97,102,108,113,118,123,127,131],{"family":5,"item":98,"code":99,"title":100,"together":101},"de-cm","DE.CM-1","Continuous Monitoring",28,{"family":103,"item":104,"code":105,"title":106,"together":107},"cis","13","Control 13","Network Monitoring and Defense",21,{"family":103,"item":109,"code":110,"title":111,"together":112},"7","Control 7","Continuous Vulnerability Management",17,{"family":103,"item":114,"code":115,"title":116,"together":117},"8","Control 8","Audit Log Management",15,{"family":103,"item":119,"code":120,"title":121,"together":122},"17","Control 17","Incident Response Management",14,{"family":103,"item":124,"code":125,"title":126,"together":77},"12","Control 12","Network Infrastructure Management",{"family":128,"item":129,"code":130,"title":130,"together":77},"itil","overview","ITIL",{"family":132,"item":133,"code":134,"title":135,"together":77},"nist-sp","800-61","SP 800-61","SP 800-61 Rev. 3: Incident Response Recommendations and Considerations for Cybersecurity Risk Management"]