In my experience, "Incident analysis" is part of a formal event lifecycle. A collection of security events, through automated or manual correlation are collected for formal analysis.
From a procedural standpoint, incident analysis may result in an investigation. The difference being the depth of analysis, the expertise of the investigator, the time they spend and the expectations of the report. If an incident takes more than a few minutes to analyze, it should be raised for an investigation, else it's interfering with daily monitoring tasks.
One problem with the word "incident" is that outside the security practice, it is a much heavier word, associated with successful breaches, denial of service, virus outbreaks etc. It's accurate there too, but when customers ask for reports of your most recent security incidents, they're not asking for the false-positive the printer generated, or the massscan which hit you on Tuesday. They want the big stuff.
Investigations also go way beyond the Incident-analysis meaning, including missing laptops, devices knocked offline, indications of inappropriate access, missing evidence of authorization before granting access to systems, etc.
For now, the meaning of the word depends on who I'm talking to. If I'm talking to SOC analysts, "Incident" means a bunch of correlated events. "Investigation" means what you're doing with those correlated events.
If I'm talking to customers or management "Incident" means a breach or similar security fail, while "Investigation" means a multi-day or multi-week thing which is going to have a root-cause analysis and will result in an ugly MS Word document filed for review by auditors, investors or customers.
The outside world and even the best product documentation confuses the language. E.g., I've been reviewing Splunk's capabilities in regard to incident analysis, even they get fuzzy on the terms... notice how it's the "Incident review" dashboard, but they talk about "Events", "Notable Events" and "investigation"
http://docs.splunk.com/Documentation/ES/latest/User/IncidentReviewdashboard
It's like they changed their mind about calling anything an "Incident".
investigation
tag:Looking at the inner workings of security systems, their interactions, and scope of coverage
and theincident-analysis
tag:Analyzing what caused an event to be flagged as an incident
– haykam May 21 '16 at 21:15