Which of the following is NOT a typical step in a security incident workflow in FOSSE?

• A. Threat Hunting
• B. Detection
• C. Containment
• D. Post-Incident Review

Answer: (A)

In a security incident workflow the steps are focused on reacting to and learning from incidents: detect the issue, contain it to limit damage, and then move into recovery and a post-incident review to capture lessons and improve defenses. Threat hunting, on the other hand, is a proactive, ongoing activity that looks for signs of attacker activity across the environment. It isn’t a defined, standard step within the incident response lifecycle; it operates outside the formal incident-handling sequence to improve detection and prevention in general. So threat hunting is not a typical step in the security incident workflow, making it the best choice.