Playbooks

Incident Response

Incident response is the structured process for identifying, containing, eradicating, and recovering from security incidents.

Steps

  1. Declare the incident and assign severity based on scope and data sensitivity
  2. Assemble the response team and open a secure communication channel
  3. Preserve volatile evidence: memory dumps, running processes, active network connections
  4. Capture and secure logs from affected systems, firewalls, and identity providers
  5. Isolate affected systems from the network to prevent lateral movement
  6. Identify the root cause and full scope of compromise across accounts and systems
  7. Contain the threat by revoking compromised credentials, blocking IoCs, and resetting sessions
  8. Eradicate attacker persistence: remove malware, backdoors, scheduled tasks, and unauthorized accounts
  9. Restore affected systems from known-clean backups and apply missing patches or configuration fixes
  10. Verify that recovery is complete and no attacker access paths remain
  11. Document the incident timeline, actions taken, and evidence collected in the case management system
  12. Conduct a post-incident review and update detection rules, playbooks, and controls based on findings

When to use

Activate this playbook whenever there is confirmed or high-confidence evidence of unauthorized access, data exfiltration, malware execution, or system compromise.