A SOC team is responding to an incident where an attacker exfiltrated 50GB of data over three weeks. The team's incident response policy requires notifying stakeholders within 24 hours of incident confirmation. When does the 24-hour notification clock typically start?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — you start the 24-hour clock when the incident is officially confirmed and declared, not when the attacker began the activity. You don't wait for the historical start of the exfiltration, because that may not be known when you discover the incident. You still need to work out the timeline during the investigation while meeting the notification requirement from the confirmation point.
Full Explanation
The correct answer is that the notification clock starts when the incident is officially confirmed and declared, not when the attacker began the activity. Notification SLAs are typically triggered by the confirmation and declaration of an incident, not by the historical start of attacker activity, which may be unknown at the time of discovery. The team must work to identify the timeline during the investigation while meeting notification requirements from the confirmation point. The option claiming that the clock starts when the exfiltration began three weeks ago is wrong because the exfiltration start date was three weeks ago and was not known; notification is triggered by confirmed discovery, not retroactive attacker activity start. The option claiming that the clock starts when the last byte of data was exfiltrated is wrong because the end of exfiltration is also in the past and doesn't trigger future notification obligations. The option claiming that the clock starts when the SIEM alert first fired, regardless of analyst review, is wrong because SIEM alerts require analyst triage and confirmation before an incident is declared; an unreviewed alert is not a confirmed incident.