Detection and analysis: IoCs, scoping, impact, severity and triage

Detection and analysis turns a raw signal into a confirmed, understood incident. It answers three questions: is this real, how big is it, and how urgent is it? Mistakes here ripple through the rest of the response. If you miss that an alert is real, the attacker keeps working; if you under-scope, you clean some systems while the attacker stays on others; if you misjudge severity, the wrong people are called too late. That is why the exam tests this phase heavily.