Response playbooks
Codified procedures, attached to an incident from its detail page and worked step by step. Progress and who completed each step are recorded, so a handover mid-incident does not lose the thread.
Account takeover response
Containment and recovery for a credential confirmed in the hands of someone other than its owner.
- 01Confirm the authentication is genuinely anomalous
Check the origin against the account travel history and any approved VPN egress before disabling anything.
Analyst - 02Disable the account and revoke active sessions
Password reset alone leaves existing tokens valid.
Analyst - 03Re-enrol multi-factor authentication
Assume any registered authenticator may have been replaced.
Service desk - 04Enumerate what the session touched
Hunt every event for the principal between first anomalous logon and containment.
Analyst - 05Check for persistence created during the session
New accounts, group changes, scheduled tasks, mail rules, OAuth grants.
Analyst - 06Notify the account owner and their manager
Out of band, not by email to the compromised mailbox.
Incident lead - 07Record the timeline and close
Export the case report and attach it to the ticket.
Incident lead
Malicious execution on an endpoint
Response to confirmed execution of unauthorised code on a managed host.
- 01Isolate the host from the network
Preserve it powered on; memory is evidence.
Analyst - 02Capture volatile evidence
Running processes, network connections, logged-on sessions.
Forensics - 03Identify the delivery path
Parent process, originating document, download source.
Analyst - 04Extract indicators and add them to the feed
Hashes, addresses and domains, so the estate is swept for the same activity.
Analyst - 05Sweep the estate for the same indicators
Run a detection sweep after adding intel; matching is retroactive.
Analyst - 06Rebuild or clear the host
Rebuild is the default; cleaning requires a documented justification.
Endpoint team
Phishing report triage
Handling a user-reported suspicious message.
- 01Retrieve the original message with headers
Forwarded copies lose the routing evidence.
Analyst - 02Detonate links and attachments in isolation
Never from a workstation on the corporate network.
Analyst - 03Determine who else received it
Search by sender, subject and any embedded link.
Analyst - 04Purge from all recipient mailboxes
Then confirm the purge actually completed.
Messaging team - 05Check whether anyone interacted before the purge
Clicks and credential submission convert this into a takeover case.
Analyst - 06Thank the reporter
Reporting rates fall when reports feel unacknowledged, and reporting is the control.
Analyst
Suspected data exfiltration
Response to an abnormal volume of data leaving the estate.
- 01Quantify what actually left
Volume, destination and the window it moved in.
Analyst - 02Block the destination at the perimeter
Contain before completing the analysis.
Network team - 03Identify the data classification involved
Determines whether this becomes a regulatory matter.
Data owner - 04Engage legal and privacy if regulated data is in scope
Notification clocks may start here, so do not delay this step.
Incident lead - 05Preserve evidence for the retention period
Raw telemetry, not just the summary.
Forensics