[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:nist-csf\u002Frs-an":3},{"item":4,"lessons":16,"controls":66,"related":96},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"nist-csf","rs-an","RS.AN-1","Incident Analysis",39,"US National Institute of Standards and Technology (NIST)","**What it asks for.** This Respond category, called Analysis in CSF 1.1, asks that investigations are conducted to ensure effective response and support forensics and recovery. It covers determining what happened and the root cause, preserving evidence and estimating incident magnitude.\n\n**In practice.** Responders follow playbooks to scope incidents, collect and preserve evidence with integrity, build timelines and identify root cause. Forensic capability exists in house or via a retainer, and incidents are categorised consistently. Evidence includes investigation records, chain of custody documentation and root cause reports.\n\n**Common gaps.** Evidence is often lost because logs were not retained or systems were rebuilt too early. Root cause analysis is frequently skipped once service is restored, so the same weakness can be exploited again.",null,"https:\u002F\u002Fwww.nist.gov\u002Fcyberframework","Open the Cybersecurity Framework at NIST","2026-10-18T15:18:43.663+00:00",{"total":9,"list":17},[18,22,26,30,34,38,42,46,50,54,58,62],{"slug":19,"title":20,"published_at":21},"ai-assisted-bank-breaches-and-poem-guided-malware-highlight-evolving-c2-evasion-tactics","AI-Assisted Bank Breaches and Poem-Guided Malware Highlight Evolving C2 Evasion Tactics","2026-10-09T14:21:32.64+00:00",{"slug":23,"title":24,"published_at":25},"russian-apt-uac-0099-upgrades-matchboil-malware-with-enhanced-stealth-against-ukrainian-targets","Russian APT UAC-0099 Upgrades MatchBoil Malware with Enhanced Stealth Against Ukrainian Targets","2026-10-08T20:21:35.327+00:00",{"slug":27,"title":28,"published_at":29},"ai-is-accelerating-vulnerability-discovery-and-exploitation-is-your-patching-keeping-up","AI Is Accelerating Vulnerability Discovery and Exploitation — Is Your Patching Keeping Up?","2026-09-30T17:20:24.468+00:00",{"slug":31,"title":32,"published_at":33},"raas-affiliate-storm-2570-highlights-danger-of-payload-focused-detection","RaaS Affiliate Storm-2570 Highlights Danger of Payload-Focused Detection","2026-09-24T20:22:40.502+00:00",{"slug":35,"title":36,"published_at":37},"cisa-guides-critical-infrastructure-on-cyber-decoy-deployment","CISA Guides Critical Infrastructure on Cyber Decoy Deployment","2026-09-17T08:20:20.381+00:00",{"slug":39,"title":40,"published_at":41},"cisa-endorses-cyber-deception-as-a-detection-and-response-strategy","CISA Endorses Cyber Deception as a Detection and Response Strategy","2026-09-16T22:20:55.835+00:00",{"slug":43,"title":44,"published_at":45},"toy-ghouls-deploy-mqtt-and-matrix-based-backdoors-against-russian-orgs","Toy Ghouls Deploy MQTT and Matrix-Based Backdoors Against Russian Orgs","2026-09-04T12:21:34.318+00:00",{"slug":47,"title":48,"published_at":49},"uac-0099-embeds-nuclear-prompts-to-blind-ai-assisted-malware-analysis","UAC-0099 Embeds Nuclear Prompts to Blind AI-Assisted Malware Analysis","2026-09-01T10:22:07.274+00:00",{"slug":51,"title":52,"published_at":53},"papercut-vulnerabilities-weaponized-in-active-hands-on-intrusions","PaperCut Vulnerabilities Weaponized in Active Hands-On Intrusions","2026-09-01T06:20:24.396+00:00",{"slug":55,"title":56,"published_at":57},"soc-alert-fatigue-why-human-only-triage-is-failing-and-how-ai-can-help","SOC Alert Fatigue: Why Human-Only Triage is Failing and How AI Can Help","2026-08-26T12:20:24.312+00:00",{"slug":59,"title":60,"published_at":61},"ai-compresses-exploit-timelines-rendering-traditional-patching-obsolete","AI Compresses Exploit Timelines, Rendering Traditional Patching Obsolete","2026-08-24T10:20:16.895+00:00",{"slug":63,"title":64,"published_at":65},"sonicwall-sma1000-flaws-actively-exploited-in-inc-ransomware-campaign","SonicWall SMA1000 Flaws Actively Exploited in INC Ransomware Campaign","2026-08-03T12:21:31.667+00:00",[67,72,77,82,87,91],{"slug":68,"name":69,"problem":70,"stories":71},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",15,{"slug":73,"name":74,"problem":75,"stories":76},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",8,{"slug":78,"name":79,"problem":80,"stories":81},"threat-intelligence","Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",7,{"slug":83,"name":84,"problem":85,"stories":86},"managed-detection-response","Managed detection and response (MDR)","A team watches and responds around the clock when you cannot.",6,{"slug":88,"name":89,"problem":90,"stories":86},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",{"slug":92,"name":93,"problem":94,"stories":95},"patch-management","Automated patch management","Known holes get closed in days, not months.",5,[97,102,108,112,117,122,127,132],{"family":5,"item":98,"code":99,"title":100,"together":101},"de-cm","DE.CM-1","Continuous Monitoring",26,{"family":103,"item":104,"code":105,"title":106,"together":107},"cis","13","Control 13","Network Monitoring and Defense",21,{"family":103,"item":109,"code":110,"title":111,"together":71},"8","Control 8","Audit Log Management",{"family":103,"item":113,"code":114,"title":115,"together":116},"17","Control 17","Incident Response Management",12,{"family":118,"item":119,"code":120,"title":120,"together":121},"itil","overview","ITIL",11,{"family":123,"item":124,"code":125,"title":126,"together":121},"nist-sp","800-61","SP 800-61","SP 800-61 Rev. 3: Incident Response Recommendations and Considerations for Cybersecurity Risk Management",{"family":103,"item":128,"code":129,"title":130,"together":131},"12","Control 12","Network Infrastructure Management",10,{"family":103,"item":133,"code":134,"title":135,"together":131},"7","Control 7","Continuous Vulnerability Management"]