Building an IR Program
Building an IR capability from the ground up — program components, staffing models, tooling decisions, maturity progression, and the tradeoffs between in-house, hybrid, and fully outsourced IR.
You've been hired as the first dedicated security hire at a 400-person company. The company has had EDR for 6 months and a basic SIEM but no IR process, no runbooks, no retainer, and no playbooks. The CISO asks: "What do we need to have a real IR capability?" This is a build-from-scratch question. This chapter answers it with a prioritized roadmap — what to do in the first 30 days, 90 days, and 6 months, and what to deprioritize until you have the fundamentals right.
IR Program Maturity Model
IR Program Maturity Levels
═══════════════════════════════════════════════════════════════════
Level 1 — REACTIVE (where most organizations start):
├── No formal IR process — response is ad hoc
├── No documentation — knowledge lives in heads
├── Alert-reactive — only respond when something fires
└── No playbooks — each incident reinvents the wheel
Level 2 — DEFINED:
├── Documented IR policy and process (what counts as P1/P2/P3)
├── Basic playbooks for 3-5 common incident types
├── IR retainer in place (someone to call at T+0)
├── Defined escalation path (who decides what)
└── Post-incident review process exists (even if basic)
Level 3 — MANAGED:
├── Full playbook library covering major incident types
├── Tabletop exercises run quarterly
├── Metrics tracked and trending (MTTD, MTTR)
├── Detection engineering connected to IR (incidents → new rules)
└── Threat hunting capability (proactive, not just reactive)
Level 4 — OPTIMIZED:
├── SOAR automating repetitive IR actions
├── Threat intelligence integrated into detection and response
├── Purple team exercises validating detection coverage
├── IR program continuously improving based on metrics
└── External reporting and peer benchmarking
Most organizations should target Level 2 first — many never get past
Level 1 despite significant investment, because they skip the
fundamentals in favor of advanced tooling.
First 30 Days: The Fundamentals
| Priority | Action | Why it comes first |
|---|---|---|
| 1 | Establish IR severity levels and escalation path. Write it down. Get sign-off. | Without agreed severity levels, every incident is an argument about priority. Without escalation path, P1s wake up the wrong people at 2 AM. |
| 2 | Establish an IR retainer with an external IR firm. | You need backup capacity before you need it. A retainer takes 2-4 weeks to establish — you can't set it up at T+0 of your first P1. |
| 3 | Review and understand your cyber insurance policy. | Know the approved vendor panel, notification requirements, and coverage limits before you're filing a claim. |
| 4 | Write a basic ransomware playbook. | Ransomware is the most common P1 scenario for most organizations. A documented, practiced response is your highest-value first playbook. |
| 5 | Confirm log retention meets minimum requirements. | SIEM: 90+ days. DC Security logs: 90+ days. EDR: 30+ days. Without retention, your IR investigations will have evidence gaps. |
Staffing Models
| Model | Best for | Tradeoffs |
|---|---|---|
| In-house SOC + IR team | Organizations with 24/7 coverage requirements, complex custom environments, regulatory constraints on data sharing | High cost (analyst salaries, benefits, training); requires significant investment in tooling and process; knowledge leaves when people leave |
| MSSP (Managed Security Service Provider) | Organizations without budget or scale for in-house SOC; 24/7 alert monitoring needed | MSSPs handle monitoring — active IR response is usually not in scope; quality varies enormously; latency in escalation; the MSSP doesn't know your environment like you do |
| MDR (Managed Detection and Response) | Organizations that want both monitoring and response capability without building in-house | Better than MSSP for IR: MDRs typically have IR capability and EDR expertise; more expensive; still limited by not knowing your specific environment and business context |
| Hybrid: in-house IR + external surge capacity | Most organizations — internal team handles day-to-day; external firm is the P1 surge capacity via retainer | Balances cost and capability; requires strong internal capability to coordinate with external firm; the sweet spot for most organizations above ~500 employees |
Tooling Priority Sequence
Don't buy advanced tools before you've mastered the basics. This is the tooling sequence — earlier items generate more value than later ones until they're working well.
IR Tooling Priority Sequence (build in this order)
═══════════════════════════════════════════════════════════════════
Tier 1 — Without these, nothing else works:
├── EDR on all endpoints (coverage, not just deployment)
├── SIEM with Windows Security events, DNS, proxy, EDR alerts
└── Log retention: 90+ days for all tier-1 sources
Tier 2 — Ops efficiency (after Tier 1 is working well):
├── Case management (TheHive or commercial alternative)
├── Runbook documentation system
└── Threat intelligence feed (even a free one: MISP, AlienVault OTX)
Tier 3 — Scale and capability:
├── Velociraptor or equivalent for fleet-wide collection
├── Network Detection and Response (NDR): Zeek + Suricata, or commercial
└── DLP with content inspection
Tier 4 — Optimization (only valuable if Tier 1-3 is mature):
├── SOAR for alert enrichment automation
├── UEBA (User and Entity Behavior Analytics)
└── Threat hunting platform
The most common failure: buying Tier 4 tools before Tier 1 works.
SOAR automation on bad alert data produces automated bad decisions.
UEBA without baseline visibility produces noise.
Tabletop Exercise Program
Tabletops reveal gaps in process and communication that don't show up in incident statistics. Run them quarterly, not annually.
| Frequency | Exercise type | Participants |
|---|---|---|
| Quarterly | Technical tabletop — specific scenario (ransomware, BEC, cloud incident). IR team + relevant technical staff. 2 hours. | IR team, SOC, network team, cloud operations |
| Semi-annual | Business tabletop — decision-making under pressure. Focuses on communication, authorization, and business continuity decisions. | IR team + CISO + C-suite representatives + legal + communications |
| Annual | Full simulation — a realistic multi-day scenario run over 4-8 hours. Involves both technical and business tracks simultaneously. | All hands — includes board representative, external counsel, IR firm |
An IR program with a well-documented runbook, practiced tabletop exercises, and clear escalation paths will outperform a program with expensive tools and no process — every time. The most common IR failure mode is not "we didn't have the right tool" — it's "nobody knew who to call, decisions took too long, and the escalation path failed." Tools matter, but they amplify process. A bad process with sophisticated tools produces automated chaos. Build the process first, then add tools that accelerate the process you've already designed. The organization that practiced the ransomware tabletop six times will respond better to real ransomware than the one that bought the best SOAR platform but never ran a tabletop.
Q & A
Q: Your organization has a $100K budget to improve IR capability. Where do you spend it?
In order: (1) IR retainer (~$25K/year for a mid-market firm) — this buys you P1 surge capacity and expert help before you need it. (2) EDR for any uncovered endpoints (~$30-50K depending on fleet size) — EDR coverage gaps are your biggest IR liability. (3) Tabletop exercises led by an external facilitator (~$10-15K for a professional scenario) — this reveals process gaps that no tool can fix. (4) Velociraptor setup and training (~$5-10K in staff time) — free tooling that dramatically expands your forensic capability. What not to spend it on: a new SIEM if you already have one working (SIEM configuration improvements come before SIEM replacement), SOAR before your alert quality is good, or any tool that requires a 6-month deployment before value is realized.
Q: Your organization has no IR program and just got hit with a significant incident. You're rebuilding from scratch post-incident. What's the priority order?
Post-incident rebuild priority: (1) Complete the current incident properly — don't shortcut eradication and recovery to rush into program building. A second incident from incomplete eradication will destroy all credibility. (2) Write the post-incident review honestly and use it as the business case for program investment — the PIR's gap list is your roadmap. (3) Stand up a retainer with an external IR firm immediately — you've now proven you need one. (4) Implement the detection gaps identified in the PIR — these are the highest-priority hardening actions because they're specific to the attacker technique that just succeeded. (5) Write your first runbooks for the incident type that just hit you. (6) Run a tabletop simulating a similar incident in 90 days — to verify the runbook works and train the team on the new process before the next real one.