Detection and response is the operating cycle of noticing suspicious activity and acting to contain the harm it may cause.
It is an organizational loop, wider than any one host product, and it includes triage, containment, communication, and recovery.
How it works
Detection is only useful when someone is accountable to look, when alerts are few enough to judge, and when the next action is already agreed.
Response may mean isolating a session, resetting access, calling a supplier, or telling affected people what to do.
The cycle improves when each case records what was seen, what was done, and what remains uncertain.
A tool that collects telemetry without an owner to act is monitoring, not response.
Concrete examples
- A duty analyst confirms an unusual export, disables the account, and calls the data owner within the same hour.
- A team distinguishes a failed login burst from a harmless misconfigured application before they wake the whole company.
- After containment, the group writes what the alert missed so the next similar case is recognized sooner.
Protective measures
- Name who is allowed to contain an incident at each hour of the week, including holidays.
- Cut alert noise until the remaining signals are ones a person can judge during a shift.
- Agree the first three containment actions in advance so the first hour is not spent inventing authority.
- Write a short case note for every response, including what you still do not know.