Incident Triage, Response, and Automation
Triage discipline
Prioritize by severity multiplied by confidence, asset criticality and potential blast radius - not arrival order. A repeatable sequence: validate the alert, scope how many hosts and accounts are affected, classify against ATT&CK, contain, eradicate, recover, then document. Skipping scoping is the most common cause of a reopened incident.
Evidence handling
Follow order of volatility: network state and memory, then running processes, then disk, then logs and backups. Capture memory before reboot or reimage. Maintain chain of custody for anything that may become evidence.
Containment options
Host network isolation with the agent still reachable; account disable plus refresh-token revocation plus password reset; indicator blocks at proxy, DNS and mail gateway; and rotation of any exposed keys or secrets. Containment is a trade-off between stopping spread and disrupting business operations, and the decision should be documented.
Automation and SOAR
Automate enrichment, notification, ticket creation and reversible containment. Place human approval gates in front of destructive or high-blast-radius actions such as wiping a host or disabling an executive account. Playbooks must be idempotent and must log every automated step for audit.
Worked example
A phishing campaign reached 30 recipients; four clicked and one submitted credentials. Reasoning: scope first by campaign identifier at the mail gateway. Containment order: revoke sessions and reset the compromised account, purge the message from all 30 mailboxes, block the sender domain, then inspect the compromised mailbox for forwarding rules or inbox rules created by the attacker. Automation handled the purge and block; the analyst approved the session revocation because it interrupts an active user.
Traps that cost marks
- Closing an alert without asking who else received or executed the same artifact.
- Reimaging before evidence is collected.
- Revoking a password but leaving active sessions alive.
- Automating destructive containment without approval gates or rollback paths.