Memory hook: Contain harm; preserve proof; restore trust.
Must remember
- Triage severity using scope, confidence, asset criticality and active impact. Establish a timeline from original events and record evidence provenance.
- Contain affected identities, endpoints or services using the least disruptive effective action. Preserve snapshots/artifacts and audit records where appropriate before destructive remediation.
- Investigate hashes, URLs, IPs, processes and cloud actions with local telemetry and threat intelligence. Identify initial access, persistence, lateral movement and affected data, not only the first alert.
- SOAR playbooks automate repeatable enrichment, notification and supported response. Use approvals for high-impact actions, scoped credentials, idempotency, error handling and bounded retries.
- Case management tracks assignment, status, evidence, escalation, handoffs and closure criteria. Ensure a failed integration does not silently close or abandon the incident.
- Coordinate recovery and long-term remediation with engineering teams. After action, improve controls, telemetry, detections and playbooks; verify the attacker’s access is actually removed.
Choose under exam pressure
| Requirement | Choice and reason |
|---|---|
| A high-confidence stolen token is actively used | Revoke/contain affected access and preserve evidence with appropriate coordination. |
| Automation may disable a business-critical account | A justified approval or pre-authorized policy gate with clear rollback/escalation. |
Traps
- Deleting every suspicious resource can destroy evidence and worsen recovery.
- A successful playbook API call does not prove the incident is resolved.
Active recall
1. What should a handoff contain?
Scope, timeline, evidence, actions taken, unresolved questions and the next owner.
2. Why make response actions idempotent?
Retries should not create duplicate or escalating harmful side effects.
3. What is root-cause analysis for?
Understanding how the incident happened so the enabling weakness can be addressed.
4. When close a case?
When defined containment, remediation, recovery and documentation criteria are met.
5. Why preserve chain of custody?
To make evidence handling and integrity defensible.