CompTIA Cybersecurity Analyst (CySA+) CS0-004 — Lesson 3: Threat Hunting, Incident Triage, Analysis, Containment, and Recovery

Learning Objectives

• Explain the roles, prerequisites, dependencies, and decision points shaping threat hunting, incident triage, analysis, containment, and recovery.
• Complete the workflow and produce incident investigation and recovery timeline that another practitioner can review.
• Resolve “containment removes visibility before evidence collection is complete” through a controlled and evidence-led troubleshooting process.

Detailed Topics

• hunt hypotheses
• indicator analysis
• malware behavior
• timeline construction
• containment
• eradication
• recovery
• evidence handling
• Security, performance, resilience, rollback, documentation, and support considerations for threat hunting, incident triage, analysis, containment, and recovery

Instructor Demonstration

The instructor demonstrates the complete threat hunting, incident triage, analysis, containment, and recovery workflow, records each material checkpoint in incident investigation and recovery timeline, and contrasts the accepted state with a controlled condition where containment removes visibility before evidence collection is complete.

Hands-On Exercise

Implement or analyze Threat Hunting, Incident Triage, Analysis, Containment, and Recovery in a controlled environment. Establish a baseline, reproduce or examine “containment removes visibility before evidence collection is complete,” isolate the proven cause, apply a reversible correction, and retain the accepted outcome in incident investigation and recovery timeline.

1. Confirm scope, access, dependencies, expected behavior, and safety constraints.
2. Execute the planned workflow while preserving configuration and operational checkpoints.
3. Test an expected path, a boundary condition, and the identified failure or exception.
4. Retest after correction and document rollback, ownership, escalation, and preventive action.

Scenario Analysis

• Identify the requirement with the greatest influence on threat hunting, incident triage, analysis, containment, and recovery.
• Compare two valid implementation or recovery choices using impact and evidence quality.
• Explain how the incident investigation and recovery timeline should be retained and transferred to the operational owner.

Troubleshooting Guidance

Start with effective configuration, recent changes, identities, connectivity, health, logs, and timing. Use incident investigation and recovery timeline to locate the earliest divergence between intended and observed behavior. Treat “containment removes visibility before evidence collection is complete” as a hypothesis until the corrected path passes the original test and a relevant boundary test.

Validation Checklist

• The implemented state for threat hunting, incident triage, analysis, containment, and recovery is traceable to approved requirements and inputs.
• The incident investigation and recovery timeline contains baseline, test, exception, correction, and accepted-result evidence.
• Security, data handling, capacity, performance, resilience, downstream impact, and rollback were considered where relevant.
• Monitoring, escalation, recovery, documentation, and support ownership are clear.

Lesson Outcome

Learners can apply Threat Hunting, Incident Triage, Analysis, Containment, and Recovery, explain the decisions made, and defend the result with incident investigation and recovery timeline.