As we saw in Chapter 1, Classifying Threats, attributing actions to threat actors is an important cybersecurity task. Additionally, pinpointing machines that were targeted is important to the containment idea from the NIST incident response plan guidelines from Chapter 7, Roles and Responsibilities During an Incident. This is particularly important if the target has actually been compromised.
In this section, we will learn how to describe the retrospective analysis method to find a malicious file or to identify compromised hosts in a network based on reports that arise from network monitoring tools and threat analyses. This will be, specifically, in the guise of an AMP threat grid, which we saw in Chapter 1, Classifying Threats. This links to objectives 4.5 and 4.6 in the 210–255 topic list: