Northwind Outfitters is a 35-person e-commerce company. One morning, the engineer who runs its systems sees an alert that a staff account logged in from a country no one works in. Do you reset the password and move on, or do you stop and ask what else is happening? Speed feels like the right answer. Speed without structure is how small problems become customer-facing ones.
Picture the scramble. Someone resets the password, but nobody records the login details. Someone else wipes a laptop, which erases the only evidence of how the attacker got in. Later, customers report strange emails, and no one can say what data was touched. Here is how that chain of events unfolds at Northwind:
A few terms keep the team speaking the same language.
An event is anything observable in a system, such as a login. An incident is an event, or a set of events, that harms or threatens the confidentiality, integrity, or availability of data or systems. Most events are harmless.
An indicator is a sign that an incident may be happening, like that foreign login. Evidence is the preserved, verified record that supports a conclusion, such as the original log entries with timestamps. An indicator tells you where to look. Evidence is what you can stand behind afterward.
That difference is why documentation matters. A written record of what you saw, did, and when lets the team coordinate during the response. It also supports customer notices and legal reporting afterward.
The National Institute of Standards and Technology (NIST) published Special Publication (SP) 800-61 Revision 2, the Computer Security Incident Handling Guide. NIST has since withdrawn it and replaced it with Revision 3, but its four-phase model remains the clearest way to learn the work. This course uses Revision 2 as its teaching frame.
The phases are Preparation, Detection and Analysis, Containment, Eradication and Recovery, and Post-Incident Activity. The cycle repeats, because lessons from one incident improve readiness for the next. Here is where each phase sits, and where triage and MITRE ATT&CK mapping fit in Northwind’s case: