Incident response
When it applies
A confirmed or suspected compromise needs a coordinated response — not just analysis, but decisions
about containment, eviction, and recovery under time pressure.
Why it works
A repeatable lifecycle keeps a stressful event from becoming chaos: it sequences the actions so you
scope before you contain, contain before you tip off the adversary, and eradicate fully before you
recover — the mistakes that turn one incident into three.
Method (NIST / PICERL lifecycle)
- Prepare (before): comms plan, roles, logging, backups, and access ready. You don't want to
build these mid-incident.
- Identify & scope: what's the initial evidence, which hosts/identities/data are involved, when
did it start? Build a timeline; collect volatile evidence first (
defense-dfir-triage).
- Contain: isolate affected hosts (network quarantine, not power-off — preserve memory),
disable compromised accounts, revoke tokens/keys. Do it broadly enough to matter but coordinate
so you don't tip off an adversary mid-scoping.
- Eradicate: remove persistence (services, tasks, startup, cloud roles), rotate all exposed
credentials, patch the entry vector. Scope drives this — miss a foothold and they return.
- Recover: restore from known-good, monitor closely for re-entry, phase systems back.
- Lessons learned: timeline, root cause, what detection would have caught it sooner → feed
defense-detection-engineering.
Gotchas
- Powering off destroys memory evidence; isolate instead.
- Partial eradication (missing one C2 or one cloud role) = re-compromise within days.
- Rotate all credentials the attacker could have touched, not just the obvious one.
Verify success
The adversary is fully evicted (no persistence, all exposed creds rotated), systems restored from a
trusted baseline, a timeline + root cause are documented, and a new detection covers the entry path.
References
NIST SP 800-61r2; SANS PICERL; the defense-dfir-triage and defense-detection-engineering skills.
1---2name: defense-incident-response3description: Run an incident end to end — detect, scope, contain, eradicate, recover, learn. Load for "we've been breached", "incident response", "contain this host", "we found malware/an intrusion", or to build an IR plan. Complements defense-dfir-triage (evidence collection) with the response process around it.4---56# Incident response78## When it applies9A confirmed or suspected compromise needs a coordinated response — not just analysis, but decisions10about containment, eviction, and recovery under time pressure.1112## Why it works13A repeatable lifecycle keeps a stressful event from becoming chaos: it sequences the actions so you14scope before you contain, contain before you tip off the adversary, and eradicate fully before you15recover — the mistakes that turn one incident into three.1617## Method (NIST / PICERL lifecycle)181. **Prepare** (before): comms plan, roles, logging, backups, and access ready. You don't want to19 build these mid-incident.202. **Identify & scope**: what's the initial evidence, which hosts/identities/data are involved, when21 did it start? Build a timeline; collect volatile evidence first (`defense-dfir-triage`).223. **Contain**: isolate affected hosts (network quarantine, not power-off — preserve memory),23 disable compromised accounts, revoke tokens/keys. Do it broadly enough to matter but coordinate24 so you don't tip off an adversary mid-scoping.254. **Eradicate**: remove persistence (services, tasks, startup, cloud roles), rotate all exposed26 credentials, patch the entry vector. Scope drives this — miss a foothold and they return.275. **Recover**: restore from known-good, monitor closely for re-entry, phase systems back.286. **Lessons learned**: timeline, root cause, what detection would have caught it sooner → feed29 `defense-detection-engineering`.3031## Gotchas32- Powering off destroys memory evidence; isolate instead.33- Partial eradication (missing one C2 or one cloud role) = re-compromise within days.34- Rotate *all* credentials the attacker could have touched, not just the obvious one.3536## Verify success37The adversary is fully evicted (no persistence, all exposed creds rotated), systems restored from a38trusted baseline, a timeline + root cause are documented, and a new detection covers the entry path.3940## References41NIST SP 800-61r2; SANS PICERL; the `defense-dfir-triage` and `defense-detection-engineering` skills.
NoorQureshi