An IDS failed to detect an event. Which of the following should you determine next?

• A. What the blast radius is
• B. The time of the incident
• C. The source of the event
• D. The alerting threshold

Answer: (A)

When an IDS misses an event, the immediate priority is to understand how widespread the impact is. Determining the blast radius reveals which assets, networks, and data were affected and how far the attacker could have moved. This insight guides containment actions (which systems to isolate or power down), helps you prioritize recovery, and informs what evidence to collect for forensic analysis.

The incident timeline and the origin of the event are still important for reconstruction and remediation, but without first knowing the scope of impact you can’t effectively contain or recover. Adjusting alert thresholds would help prevent future misses, but it doesn’t address what’s already happened.