The life of security professionals in operational roles, monitoring or maintaining systems, tends to be one of routine much of the time. Alerts are monitored and investigated, new indicators of compromise (IOCs) and detection use cases created, firewall and other detection rules updated, and threat research carried out.
However, this can change rapidly when a significant incident is detected. During an incident response, time is of the essence and routine is put aside.
