Detection and analysis

- Alert triage workflow (severity, scope, confidence) - Common incident types and playbooks: * Malware outbreak (lateral movement, persistence) * Credential compromise (account takeover, OAuth abuse) * Data exfiltration (DLP alerts, egress anomalies) * Insider threat (data access, behavior anomalies) * Web application attack (SQLi, XSS, SSRF) * Cloud compromise (resource hijacking, cryptomining) * Supply chain (third-party breach, dependency compromise) * DDoS (volumetric, application, protocol) - Forensic artifact collection and chain of custody