Study guide
7.2 NIST CSF: Identify, Protect, Detect, Respond, Recover
TryHackMe Security Analyst Level 1 SAL1
Track your progress as you read
Finished sections get a check mark.
1 Introduction & Exam Overview
1.1 Current SAL1 Exam Facts 1.2 24-Hour Window, Check-In, and Delivery 1.3 Scoring, Retakes, Validity, and Access 1.4 MCQ Section Strategy
2 SOC Simulator Exam Skills
2.1 Analyst VM, Splunk, and Dynamic Alerts 2.2 Classification and Escalation Scoring 2.3 Case Reports and Investigation Notes
3 Network Essentials
3.1 OSI, TCP/IP, Devices, and the Three-Way Handshake 3.2 HTTP, TLS, VPN, Web Browsing, and Email Transmission
4 Operating System Basics
4.1 Windows and Linux Architecture, Auth, Filesystems, Processes 4.2 Active Directory and Event Logs for Tracing Activity
5 Cryptography, Cloud, Web and Scripting Basics
5.1 Encoding, Encryption, Hashing, and Decoding Tools 5.2 VMs vs Hosts, Cloud vs Virtual Hosting, SaaS and IaaS 5.3 Web Apps, APIs, JSON/XML, Scripts vs Compiled Programs
6 Cybersecurity Fundamentals and MITRE ATT&CK
6.1 CIA, Least Privilege, Human Factors, Log4Shell, EternalBlue 6.2 Navigating MITRE ATT&CK: Tactics, Techniques, Sub-techniques 6.3 Mapping Real Attacks onto ATT&CK Techniques
7 Kill Chain, NIST CSF, and Attack Indicators
7.1 Cyber Kill Chain Stages vs MITRE ATT&CK 7.2 NIST CSF: Identify, Protect, Detect, Respond, Recover 7.3 IoC vs IoA and the Pyramid of Pain
8 Social Engineering and Network Attacks
8.1 Phishing: Impersonation, Typosquatting, Spoofing, Header Analysis 8.2 SPF, DKIM, DMARC, and Email Authentication Results 8.3 Port Scanning, DDoS, and Man-in-the-Middle 8.4 DNS Poisoning, ARP Spoofing, Exfiltration, and C2 Traffic Patterns
9 Web Exploitation and Endpoint Attacks
9.1 Client vs Server Vulnerabilities, XSS, and SQL Injection 9.2 Code Injection, Path Traversal, Input Validation, Patching, WAF 9.3 Initial Access (RDP/SSH), Persistence, Privilege Escalation 9.4 Credential Theft, Mimikatz, Sysmon, and Auditd
10 Command and Control, Malware, and LOLBAS
10.1 Forward vs Reverse Shells, Beaconing, Metasploit, Cobalt Strike 10.2 Malware Types, Static vs Dynamic Analysis, LOLBAS
11 EDR, Firewalls, and WAF
11.1 EDR vs AV, Telemetry, Containment, Remote Shell 11.2 Firewall Deployments, Limits, and Log Analysis 11.3 WAF Capabilities, Limits, and Rule Creation
12 SIEM and SOAR
12.1 SIEM Deployments, Parsing, and Raw Logs to Alerts 12.2 Alert Management, Threat Hunting, Triage, Reporting 12.3 SOAR Playbooks, Enrichment, and TI Integration
13 Threat Intelligence and Vulnerability Scanning
13.1 Feeds, Indicators, Classifying IPs, Domains, and Hashes 13.2 YARA and TI Integration with SIEM/SOAR 13.3 External vs Internal, Web vs Network Scanning
14 SOC Team, Activities, and Alert Triage
14.1 Blue/Red Teams, Hierarchy, and SOC Roles 14.2 Proactive vs Reactive: FP Remediation, Detection Engineering, Tabletop, DFIR, Threat Hunting 14.3 Workbooks; Ticket vs Alert vs Detection Rule 14.4 Triage Workflow, Severity, Status, and Verdicts
15 SOC Metrics, Escalation, and Communication
15.1 MTTA, MTTD, MTTR, SLA, and Lookups 15.2 Escalation Matrix, Urgent Remediation, and Cross-Team Communication
7.2 NIST CSF: Identify, Protect, Detect, Respond, Recover
Key Takeaways Explain This Topic AI
SAL1 training content names five NIST Cybersecurity Framework stages: Identify, Protect, Detect, Respond, and Recover.
NIST CSF 2.0 added Govern in February 2024; treat Govern as current context, not a replacement for the five-stage SAL1 list.
Identify is knowing assets and risk; Protect is safeguards; Detect is finding attacks; Respond is incident action; Recover is restoring operations.
A junior SOC analyst's shift work concentrates on Detect and Respond, but Identify, Protect, and Recover still appear in MCQ-style questions.
A ransomware chain can be mapped onto all five functions and often exposes Identify and Protect failures before the first SOC alert.
Last updated: September 2026
What SAL1 expects you to name
The National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) organizes how an organization manages cybersecurity risk. SAL1 training content names five stages : Identify , Protect , Detect , Respond , and Recover . You must know the high-level purpose of each and be able to map a real attack chain onto those stages.
In February 2024, NIST published CSF 2.0 , which added a sixth function, Govern (cybersecurity strategy, roles, policies, and oversight). Remember Govern as current industry context so a news headline does not surprise you. Do not replace the five-stage list SAL1 training content uses. If an item asks for the CSF stages covered in that training, answer with Identify, Protect, Detect, Respond, and Recover.
The CSF is a defender program model . It is not an attacker lifecycle. Mixing it with the Cyber Kill Chain is a common trap: Kill Chain stages describe what the adversary does; CSF functions describe what the organization must be able to do before, during, and after incidents. Functions also run concurrently in a mature program—Protect does not wait for Identify to be perfect forever—but SAL1-style questions still want the five names and purposes.
This section is independent study material covering those SAL1 topics.
Identify
Purpose: Know what you have, why it matters, and what could go wrong. You cannot protect, detect, or recover assets you have not listed.
High-level work includes:
- Hardware, software, cloud, and data inventory
- Business context (electronic health record vs a marketing microsite)
- Vulnerability and risk assessment
- Understanding suppliers and other third parties who touch those systems
SOC-relevant traces of Identify failure: nobody owns a public Remote Desktop Protocol (RDP) jump box; the asset list still shows a retired file server as production; the risk register never mentioned that backups share a network with the workstations they are supposed to save.
MCQ flavor: missing inventory, unknown shadow IT, not knowing where crown-jewel data lives. Identify is often paperwork and architecture, not a SIEM rule, which is why junior analysts under-study it and then miss easy items.
Protect
Purpose: Apply safeguards that reduce the likelihood or impact of events. After you know the assets, you secure them.
High-level work includes identity and access control (including multi-factor authentication), awareness training, data security (encryption, least privilege on shares), hardening and patching, email and web controls, and backups that ransomware cannot immediately encrypt (offline, immutable, or otherwise isolated).
SOC analysts do not own every Protect control, but they inherit the consequences: macros allowed from the internet, no MFA on VPN, backups sitting on the same Server Message Block (SMB) share the encryptor will hit. When a question describes a missing safeguard rather than a missing alert, think Protect.
Detect
Purpose: Find and analyze anomalies, indicators of compromise, and other signs that an attack or disruption is underway—in time to do something.
High-level work includes continuous monitoring, log collection, detections in security information and event management (SIEM) and endpoint detection and response (EDR) tools, spotting deviations from baseline, and testing that detections still fire after a parser change.
This is the home turf of a junior SOC analyst: alert queues, hunt queries, true positive vs false positive. Detect is not install antivirus and forget it. It is the ability to notice this encryption storm, this impossible-travel login, this new service installing at 02:14.
Respond
Purpose: Take action on a detected incident: contain effects, investigate, coordinate, and mitigate.
High-level work includes incident management, analysis (what happened, what is in scope), mitigation (isolate a host, disable an account, block C2), reporting, and communications with internal teams and leadership (and, when policy requires it, customers or regulators).
Respond is not Recover. Turning off a network interface is Respond. Restoring the billing server from backup is Recover. Writing a case report that lists what you isolated and which indicators you blocked is Respond work, even when a later team handles restoration.
Recover
Purpose: Restore assets and operations that the incident affected, and communicate during restoration, so the organization returns to an acceptable state.
High-level work includes recovery planning, restoring systems and data, validating that restored systems are clean, lessons-learned that feed Identify, Protect, and Detect, and stakeholder communication (pharmacy systems are back as of 18:40).
If backups were never isolated, Recover fails even when Detect and Respond were heroic. That is why Identify and Protect still appear on entry-level items even though the analyst's shift is mostly tickets.
Where a SOC analyst actually lives
Day to day, a SOC spends most clock time in Detect (alerts, hunts, monitoring) and Respond (containment, escalation, case notes). That does not make the other functions exam-irrelevant. Items will ask which function is missing when:
Nobody knows which servers store cardholder data ( Identify ).
MFA was never enforced on the jump host ( Protect ).
Backups restore failed because they were online and encrypted too ( Recover ).
Think of Detect and Respond as the analyst's desk, and Identify, Protect, and Recover as the program that determines whether that desk can succeed.
Stage High-level purpose Example question stem Typical SOC contact
Identify Know assets, context, and risk Which servers hold patient images? Weak: you discover the gap during an incident
- Protect Apply safeguards Why was RDP password-only? You inherit the missing control
- Detect Find and analyze attacks Which alert fired and was it true? Alert queue, hunts
- Respond Act on a declared incident Isolate, disable, escalate, document Playbooks, tickets, case reports
Recover Restore operations When did billing return, and from what backup? You may support; IT/business owns the restore
Worked mapping: ransomware onto the five stages
Story. A clinic allows RDP to a jump box with a password-only local administrator account. An attacker password-sprays at 01:12, stops a leftover Microsoft Defender service, deploys encryptors across SMB shares, and drops HOW_TO_RECOVER.txt . Backups are a nightly copy to \\backup01\nightly , still mounted. EDR fires at 01:47 on mass file-renames. The analyst isolates two hosts at 01:58, but billing stays down until paper processes take over. Restoration from a month-old offline USB archive begins the next afternoon.
Identify. The clinic's asset list did not flag the jump box as internet-exposed, and the risk assessment never asked what happens if backup01 is reachable with the same admin hash. Identify failed before the first packet.
Protect. No MFA on RDP, a reused local admin, tamper protection off, backups not immutable or offline, limited training on unexpected remote access. Several Protect safeguards were absent. MFA on RDP, or offline backups, would have changed the night even if Detect was slow.
Detect. The useful detection was the EDR mass-rename alert at 01:47. A healthier Detect program would also have surfaced earlier signals: RDP from an unusual network at 01:12, Defender stopped, a new privileged logon. Detect succeeded late but not never.
Respond. Isolation of hosts, disabling the sprayed account, blocking the encryptor hash and any C2, preserving disk evidence, paging IT to take backup01 offline, and notifying leadership. That is Respond: managing the incident, not yet we are fine.
Recover. Restore from the offline USB archive, rebuild the jump box rather than treating ransom payment as the only path, verify integrity, bring billing back, communicate restoration times, and feed lessons (MFA, inventory, backup design) back into Identify and Protect.
Kill Chain overlay (do not confuse the models): password spray against RDP is Delivery and Exploitation of that service; encrypting shares is Actions on Objectives. CSF overlay: the organization's gaps sit in Identify and Protect; the SOC night shift is Detect and Respond; the business returning to care delivery is Recover.
CSF versus the attacker-side models
- Model Whose actions? Shape What you use it for
- Cyber Kill Chain Adversary Seven attack stages Understand the attack lifecycle
- MITRE ATT&CK Adversary behaviors Tactics and techniques Map detections and procedures
NIST CSF (SAL1 five) Defender organization Identify, Protect, Detect, Respond, Recover Map program functions and incident handling
A single ransomware night can be narrated in all three: ATT&CK techniques for the encryptor, Kill Chain stages for the storyboard, CSF functions for which part of our program failed or worked.
Exam traps
Listing Govern as one of SAL1's five training stages. Mention it as CSF 2.0 context from 2024; keep the five-stage list for SAL1-style answers.
Calling restore from backup Respond. Restoration is Recover; isolating systems and declaring the incident is Respond.
Calling the CSF a kill chain. It describes defender outcomes, not adversary stages.
Assuming junior analysts never get Identify questions. They do: inventory, data classification, which function is asset management.
Treating Detect as only a product name. Detect is the outcome: attacks are found and analyzed.
Memory hook: Identify what matters, Protect it, Detect when something goes wrong, Respond to the incident, Recover the business.