The DAIR Model: Dynamic Approach to Incident Response

Incident response can get messy. While many frameworks suggest a linear path, the DAIR model acknowledges that investigations are often a loop of discovery and action. I think in practice, it is easier to outline this process in the new format that is being presented, known as the DAIR model.

DAIR Model of Incident Response

What is DAIR?

DAIR stands for Dynamic Approach to Incident Response. It is a flexible framework designed to be iterative rather than strictly sequential. Its origin is somewhat unknown as far as I can tell, but it is gaining visibility. You can find it referenced on SANS’ website for their SEC504 course.

The goal of the framework is to verify, scope, and remediate threats simultaneously as new info is discovered.

Alternatives

Most organizations still lean on older models:

• SANS PICERL: (Preparation, Identification, Containment, Eradication, Recovery, Lessons Learned).
• NIST 800–61: The standard 4-phase US government model.
• ISO/IEC 27035: The formal international standard.

Its important in my mind, to note that these models aren’t necessarily out of date. SANS PICERL, NIST, and DAIR are all very similar. There have been broad discussions that DAIR is not needed, because these older frameworks can be as iterative or flexible as you need them to be. While that may be true, I think the presentation of the framework is important. DAIR makes it crystal clear, and outlines the response loop in a bit more detail.

Why DAIR?

The primary reason to use DAIR over PICERL is that PICERL is often visualized as a one-way street. DAIR is built for flexibility. It assumes you might be in the middle of “Eradication” and find a new pivot point that forces you back to “Scoping.” It just feels more like how actual security work happens.

The DAIR Process

1. Preparation

You cannot respond to what you aren’t ready for. This phase covers:

• Policies, documentation, and team assembly. This could also include training.
• Training and tool setup and visibility (SIEM, EDR/AV, IAM, etc).
• Hardening systems to minimize the attack surface.

2. Detection

The trigger for the process. This involves collecting data from your systems, endpoint protection, cloud systems, etc. Ideally these logs should be sent to a SIEM for monitoring, where SIEM rules (such as the SIGMA format) can run to look for pattern matches and anomalies. The focus is on effective correlation to find the real “signal” without being buried in noise. The detection portion itself is directly linked to your ability to passively discover threats via alerting, or actively via threat hunting.

3. Verify and Triage

Once an alert hits, you must confirm it’s real. Gather evidence, perform artifact analysis, and contextualize the activity. This is where you prioritize the incident based on its severity.

4. Response Actions Loop

This is the core of the model. It is an iterative cycle rather than a list of steps.

• Scope: Analyze Horizontally (pivot points), Vertically (privilege escalation), and Data (files/drives) impact. Identify IoCs and time windows.
• Contain: Stop the bleeding. Isolate hosts, disable accounts, and block malicious IPs or domains.
• Eradicate: Remove malware and artifacts. You must identify the root cause so they dont just jump back in.
• Recover: Restore operations, validate the environment, and test systems.

NOTE: Preserve Evidence: Ensure all data stays forensically sound throughout the loop.

5. Debrief

After the threat is gone, you reconstruct the incident. This includes:

• Creating a timeline and Executive Summary.
• Root Cause Analysis (RCA) to find gaps.
• Remediation tracking to ensure weaknesses are actually fixed.

DAIR is a shift toward a realistic way of handling modern breaches.