Incident Response Playbook
An action-oriented incident response playbook covering preparation, detection, containment, eradication, recovery and lessons learned.
Quick Answer
Respond to a security incident by following the NIST cycle — prepare, detect & analyze, contain, eradicate, recover, post-incident — preserving evidence before any action and keeping a chronological record.
Definition
A structured, executable procedure to prepare for, detect, contain, eradicate, recover from and learn after a security incident, aligned to the NIST incident-response lifecycle.
Scenario
Any suspected security incident: unauthorized access, malware, account compromise, data exfiltration, or ransomware. This playbook is the umbrella procedure; apply topic-specific playbooks (phishing, malicious URL, Log4Shell) for details.
Goal
Detect and analyze the event, contain it to prevent spread and data loss, eradicate the cause, recover verified operations, and feed lessons learned back into prevention. Preserve evidence at every step.
Prerequisites
- Predefined roles (incident commander, analyst, comms, legal/PR) and an on-call list.
- Backup, restore and kill-switch runbooks tested in advance.
- Authorized tooling: hashing
guides:tool-hash-guide, IOC lookupguides:tool-ioc-guide, CVE triageguides:tool-cve-guide.
Evidence Collection
- Order: volatile first (memory, connections, logged-on users), then disk, then network/cloud, then logs.
- Record SHA-256 of each artifact; maintain a write-once, chronological evidence log.
- Note every analyst action with timestamp; do not modify evidence before capture.
Indicators
- Known-bad hashes, domains, IPs, email indicators (IOC lookup); abnormal auth patterns; FTS/tool hits against
security:what-is-an-ioc.
Validation
- Confirm the alert is a real incident, not a false positive: correlate ≥2 evidence streams (e.g., network + endpoint + auth logs) before declaring.
Investigation
- Reconstruct the kill chain: initial access → execution → persistence → data movement. See
security:threat-detectionand follow topic playbooks.
Decision
- Declare a containment scope and owner. If P0 (breadth/severity high) escalate to the incident commander immediately.
Containment
- Isolate affected hosts/accounts (disable credentials, segment network), preserve evidence first, and implement short-term blocks (e.g., block C2 domains/IPs in
security:network-security).
Mitigation
- Remove persistence artifacts, patch the exploited vulnerability (see
guides:tool-cve-guide/guides:cve-patch-triage-checklist), and rotate exposed credentials.
Recovery
- Restore from verified clean backups, validate integrity (hashing), confirm removal of backdoor access, then return systems to service under increased monitoring.
References
- NIST SP 800-61 · CISA Incident Handling resources as listed above.
References
Ask OpenTrojan's evidence-backed assistant about this topic — answers cite their sources.