Incident Response Field Guide

Most incidents are won or lost in the first hour. Experienced responders contain the attacker without destroying the evidence, without tipping them off, and without making the business pay more than it has to. This guide is the condensed version of how we run that hour and everything after it. It follows the lifecycle NIST describes in SP 800-61, which now maps incident response onto the Detect, Respond and Recover functions of the Cybersecurity Framework 2.0.

Readiness: decided before the incident

Nothing on this list can be improvised under pressure. If it does not exist on a calm Tuesday, it will not exist at 3 a.m.

• Decision authority: who can isolate production, take systems offline, and engage outside counsel, without waiting for a meeting.
• An out-of-band channel: assume email, chat and the identity provider are compromised. Keep a pre-agreed alternative and a phone tree on paper.
• Telemetry that outlives the attacker: centralized, tamper-resistant logs with at least 90 days of retention, every clock synced to UTC, and identity, endpoint and cloud control-plane logs included.
• Break-glass accounts: offline-stored, monitored admin credentials that do not depend on the identity provider you may need to distrust.
• A notification matrix: regulators, customers and insurers, each with its deadline. GDPR, for example, requires notifying the supervisory authority of a personal-data breach within 72 hours of becoming aware of it.
• Restorable backups: immutable, offline copies with a restore you have actually timed.

The first hour

1. Declare the incident and name one incident commander. The commander coordinates and decides; they do not do hands-on analysis.
2. Move the response to the out-of-band channel and keep the circle need-to-know.
3. Start a UTC timeline immediately: every observation, action, actor and timestamp. It becomes your report, your legal record and your lessons learned.
4. Scope before you touch anything: which identities, hosts, tenants and data are involved, and is the activity ongoing?
5. Preserve volatile evidence from the most important systems before changing their state.
6. Choose a containment strategy deliberately (next sections), then set a cadence for updates, such as every 60 minutes for a SEV-1.

Triage and severity

Severity drives staffing, communication and spending authority, so define it in business terms rather than technical ones.

• SEV-1: active attacker with privileged access, confirmed data exfiltration, ransomware execution, or a customer-facing outage. All hands, executive bridge, legal engaged.
• SEV-2: confirmed compromise contained to limited scope (one host, one account), no evidence of lateral movement yet. Dedicated responders, daily executive update.
• SEV-3: suspicious activity or a policy violation without confirmed compromise. Handled in the normal security queue.

Evidence: volatility first

Collect in order of volatility, as RFC 3227 recommends: memory and live network state first, then running processes, then disk, then logs and backups. Hash everything you collect, record who handled it and when, and write to separate media, never to the suspect system.

date -u                                        # anchor the timeline in UTC
uptime; who -a; last -Faiwx | head -50         # sessions and logins
ss -tunap                                      # live connections with owning processes
ps auxwwf                                      # full process tree and arguments
ls -l /proc/*/exe 2>/dev/null | grep deleted   # binaries deleted while running
find / -xdev -type f -mtime -2 2>/dev/null     # files changed in the last 48h
sha256sum triage-*.txt > triage.sha256

Capture memory with a purpose-built tool (for example AVML or LiME on Linux) before anything else on systems where in-memory implants are plausible. On cloud workloads, snapshot disks and export control-plane logs before you terminate or replace anything.

Containment without tipping off the attacker

A visible, partial response warns the attacker, who then accelerates, destroys evidence, or digs in deeper. Scope first, then contain everything you know about in one coordinated move.

• Isolate hosts with EDR network containment rather than powering them off; memory is evidence.
• Reset credentials in one coordinated sweep after scoping: affected users, admins, service accounts, API keys and tokens. Piecemeal resets let the attacker watch and adapt.
• In Active Directory, reset the KRBTGT account twice, allowing replication between resets, to invalidate forged Kerberos tickets.
• In cloud tenants, revoke sessions and refresh tokens, rotate access keys, and look for attacker persistence: new IAM users or roles, federated trust changes, OAuth app consents, and mailbox forwarding rules.
• Block known command-and-control infrastructure at egress, and expect the attacker to have backups of it.

Eradication and recovery

Eradication is finished when you can explain the initial access and have removed every persistence mechanism, not when the alerts stop. Hunt for scheduled tasks and cron jobs, new services, run keys, SSH authorized_keys entries, web shells, rogue admin accounts and backdoored CI/CD credentials.

• Rebuild compromised systems from known-good images instead of cleaning them in place.
• Restore data from a backup taken before the earliest confirmed attacker activity, and scan it before reconnecting.
• Close the initial access vector first; otherwise recovery is just re-infection with extra steps.
• Bring services back in stages under heightened monitoring, with detections written specifically for this attacker’s techniques.

Communication under pressure

• Maintain one source of truth, owned by the incident commander, and keep internal updates factual: what we know, what we do not know, and what happens next.
• Involve legal counsel early, both for notification obligations and to establish privilege over the investigation where applicable.
• Never speculate publicly about scope or attribution. Corrections cost more credibility than silence.
• For ransomware, involve law enforcement and counsel before any discussion of payment. The US Treasury (OFAC) warns that paying sanctioned actors can itself be a violation.

After action

Hold a blameless review within two weeks, while memories are fresh. Rebuild the full timeline from initial access to recovery, and measure dwell time, time to detect and time to contain.

Every finding should end as a change: a new detection, a hardened control, an updated playbook, or a tabletop exercise that tests the gap. An incident that changes nothing will happen again.