FixTheVuln

Incident Response Guide

By FixTheVuln Team Peer-reviewed security content Sources: CISA, NVD, OWASP

Key Takeaways

Test Your Knowledge

CySA+ Practice Quiz GCIH Practice Quiz Security+ Practice Quiz
← Back to Home

Security Incident Response

Quick reference for handling security incidents - from detection through recovery. Based on NIST SP 800-61 framework with practical checklists and procedures.

Incident Response Phases (NIST)

Phase Key Activities Goal
1. Preparation Build IR team, tools, playbooks, training Be ready before incidents occur
2. Detection & Analysis Monitor, detect, validate, assess severity Identify and understand the incident
3. Containment Stop spread, preserve evidence, short/long-term Limit damage and scope
4. Eradication Remove threat, patch vulnerabilities, clean systems Eliminate the root cause
5. Recovery Restore systems, verify functionality, monitor Return to normal operations
6. Lessons Learned Post-incident review, update procedures, report Improve future response

Incident Severity Classification

Severity Description Response Time Examples
Critical (P1) Business-critical systems down, active breach, data exfiltration Immediate (15 min) Ransomware, active attacker, data breach
High (P2) Significant impact, potential for escalation < 1 hour Compromised admin account, malware spread
Medium (P3) Limited impact, contained threat < 4 hours Phishing success, single compromised host
Low (P4) Minimal impact, policy violation < 24 hours Failed attack, suspicious activity

Initial Response Checklist

First 15 Minutes

  • Validate the alert - Confirm it's a real incident, not false positive
  • Assess severity - Use classification matrix above
  • Notify IR lead - Escalate based on severity
  • Start incident log - Document everything with timestamps
  • Preserve evidence - Don't restart systems yet
  • Initial containment - Isolate if critical

Critical Information to Gather

Category Information Needed
What Type of incident, systems affected, data at risk
When Detection time, estimated start time, timeline
Where Affected hosts, networks, geographic locations
Who Affected users, reporter, potential threat actor
How Attack vector, indicators of compromise (IOCs)
Impact Business impact, data sensitivity, regulatory

Containment Procedures

Short-Term Containment

# Network Isolation
# Isolate compromised host from network
sudo iptables -A INPUT -s [COMPROMISED_IP] -j DROP
sudo iptables -A OUTPUT -d [COMPROMISED_IP] -j DROP

# Or disconnect from VLAN/switch port
# Using network management tools

# Disable compromised user account
# Active Directory
Disable-ADAccount -Identity [USERNAME]

# Linux
sudo usermod -L [USERNAME]
sudo pkill -u [USERNAME]

# Cloud (AWS)
aws iam update-login-profile --user-name [USERNAME] --no-password-reset-required
aws iam delete-login-profile --user-name [USERNAME]

# Revoke active sessions
# Invalidate all tokens/sessions for compromised account

Long-Term Containment

  • Rebuild compromised systems from known-good images
  • Apply emergency patches for exploited vulnerabilities
  • Reset credentials for affected accounts and services
  • Block IOCs at firewall, proxy, and endpoint
  • Increase monitoring on similar systems
  • Segment network to prevent lateral movement

Containment by Incident Type

Incident Type Containment Actions
Ransomware Isolate infected hosts, disable network shares, preserve encrypted files, check backups
Compromised Account Disable account, revoke sessions, reset password, review access logs
Malware Infection Isolate host, block C2 domains/IPs, scan similar systems
Data Breach Identify data accessed, revoke access, preserve logs, legal notification
DDoS Attack Enable DDoS protection, block source IPs, scale infrastructure
Insider Threat Disable access quietly, preserve evidence, involve HR/Legal

Evidence Collection

Order of Volatility (Collect First to Last)

Priority Evidence Type Collection Method
1 Memory (RAM) Memory dump before shutdown
2 Network connections netstat, ss, network captures
3 Running processes ps, tasklist, process memory
4 Open files lsof, handle
5 System logs Event logs, syslog, auth logs
6 Disk image Full forensic image
7 Backup media Compare with compromised state

Evidence Collection Commands

# Linux Evidence Collection

# Memory dump (requires root)
sudo dd if=/dev/mem of=/evidence/memory.dump bs=1M

# Or using LiME
sudo insmod lime.ko "path=/evidence/memory.lime format=lime"

# Running processes with full details
ps auxwww > /evidence/processes.txt
ls -la /proc/*/exe 2>/dev/null > /evidence/proc_exe.txt

# Network connections
ss -tulpn > /evidence/network_connections.txt
netstat -anp > /evidence/netstat.txt

# Open files
lsof > /evidence/open_files.txt

# System logs
cp -r /var/log /evidence/logs/

# User activity
last > /evidence/last_logins.txt
lastlog > /evidence/lastlog.txt
cat /home/*/.bash_history > /evidence/bash_histories.txt

# Scheduled tasks
crontab -l > /evidence/crontab.txt
ls -la /etc/cron* > /evidence/cron_files.txt

# Disk image (forensic copy)
sudo dd if=/dev/sda of=/evidence/disk.img bs=4M status=progress
# Calculate hash
sha256sum /evidence/disk.img > /evidence/disk.img.sha256
# Windows Evidence Collection (PowerShell as Admin)

# Running processes
Get-Process | Export-Csv C:\Evidence\processes.csv

# Network connections
Get-NetTCPConnection | Export-Csv C:\Evidence\network.csv

# Services
Get-Service | Export-Csv C:\Evidence\services.csv

# Scheduled tasks
Get-ScheduledTask | Export-Csv C:\Evidence\tasks.csv

# Event logs
wevtutil epl Security C:\Evidence\Security.evtx
wevtutil epl System C:\Evidence\System.evtx
wevtutil epl Application C:\Evidence\Application.evtx

# Registry (common persistence locations)
reg export HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run C:\Evidence\run.reg
reg export HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run C:\Evidence\run_user.reg

# Memory dump (requires Sysinternals or WinPMEM)
winpmem.exe C:\Evidence\memory.raw

Communication Templates

Internal Notification (Leadership)

SECURITY INCIDENT NOTIFICATION

Severity: [CRITICAL/HIGH/MEDIUM/LOW]
Incident ID: INC-2026-001
Date/Time Detected: [TIMESTAMP]

SUMMARY
[Brief description of incident - 2-3 sentences]

CURRENT STATUS
- Impact: [Systems/data affected]
- Containment: [Actions taken]
- Investigation: [Current phase]

BUSINESS IMPACT
- [List affected services/operations]
- [Customer/data impact if known]

NEXT STEPS
1. [Immediate action]
2. [Short-term action]
3. [Communication plan]

NEXT UPDATE: [Time]
IR Lead: [Name] | Contact: [Phone/Email]

Customer Notification (Data Breach)

Subject: Important Security Notice from [Company]

Dear [Customer Name],

We are writing to inform you of a security incident that may have affected your personal information.

WHAT HAPPENED
On [DATE], we discovered unauthorized access to [SYSTEM]. Our investigation determined that [DESCRIPTION].

WHAT INFORMATION WAS INVOLVED
The following types of information may have been accessed:
- [List data types]

WHAT WE ARE DOING
- [Remediation actions taken]
- [Security improvements implemented]
- [Third-party investigation if applicable]

WHAT YOU CAN DO
- [Specific recommendations]
- [Password reset if needed]
- [Credit monitoring offer if applicable]

FOR MORE INFORMATION
Contact our dedicated response team at [EMAIL/PHONE]
Visit [URL] for updates

We sincerely apologize for any concern this may cause.

[Signature]

Post-Incident Review

Lessons Learned Meeting Agenda

  • Timeline review - What happened and when
  • What worked well - Effective detection/response
  • What could improve - Gaps and delays
  • Root cause analysis - Why did this happen
  • Action items - Specific improvements with owners
  • Metrics review - Time to detect, contain, resolve

Key Metrics to Track

Metric Description Target
MTTD Mean Time to Detect < 24 hours
MTTA Mean Time to Acknowledge < 15 minutes
MTTC Mean Time to Contain < 4 hours
MTTR Mean Time to Resolve < 72 hours
Dwell Time Time attacker was present undetected < 7 days

IR Quick Reference Card

Phase Key Actions
Detect Validate alert, assess severity, start documentation
Contain Isolate systems, disable accounts, preserve evidence
Investigate Collect evidence, identify IOCs, determine scope
Eradicate Remove malware, patch vulnerabilities, reset credentials
Recover Restore from backup, verify clean, increase monitoring
Learn Document findings, update procedures, implement improvements

IR Playbook Templates

Pre-built response checklists for the most common incident types. Adapt these to your environment.

Ransomware Playbook

  1. Isolate immediately — disconnect affected systems from the network (do NOT power off)
  2. Identify variant — check ransom note, file extensions, and ID Ransomware (id-ransomware.malwarehunterteam.com)
  3. Preserve evidence — image affected drives before any remediation
  4. Assess blast radius — check network shares, backup integrity, and domain controller status
  5. Notify stakeholders — legal, executive team, law enforcement (FBI IC3), cyber insurance carrier
  6. Do NOT pay ransom without legal counsel — payment doesn't guarantee decryption and may violate OFAC sanctions
  7. Eradicate — rebuild from clean images, reset ALL credentials (assume full domain compromise)
  8. Restore — recover from offline/immutable backups, verify data integrity
  9. Harden — patch entry vector, enable MFA everywhere, segment network, review RDP exposure

Phishing Incident Playbook

  1. Collect the email — preserve original headers (don't just forward), save .eml file
  2. Identify recipients — query mail logs for all recipients of the same message ID
  3. Check who clicked — review proxy/web logs for URL visits, check EDR for payload execution
  4. Reset credentials — force password reset for anyone who entered credentials, revoke active sessions
  5. Scan endpoints — run EDR scan on systems that accessed the phishing URL or opened attachments
  6. Block IOCs — add sender domain, URL, and payload hash to blocklists
  7. Notify users — send org-wide alert with screenshots of the phishing email
  8. Report — submit to Anti-Phishing Working Group ([email protected])

Compromised Credentials Playbook

  1. Disable account — immediately disable the compromised account in IdP/AD
  2. Revoke sessions — terminate all active sessions, OAuth tokens, and API keys
  3. Audit access — review login history for unauthorized access (source IPs, timestamps, geolocations)
  4. Check lateral movement — review if the account accessed other systems, elevated privileges, or created new accounts
  5. Review data access — check file downloads, email forwarding rules, shared drive activity
  6. Reset and harden — new password + enforce MFA, review and remove forwarding rules
  7. Credential stuffing check — verify the same password isn't reused across other corporate accounts
  8. Monitor — enhanced monitoring on the account for 30 days post-incident

Data Exfiltration Playbook

  1. Identify the channel — DNS tunneling, HTTPS to cloud storage, USB, email attachment, or API exfiltration
  2. Block the exfil path — firewall rule to block destination IP/domain, disable USB ports, revoke cloud storage access
  3. Quantify the breach — determine what data was accessed, volume transferred, and time window
  4. Classify data sensitivity — PII, PHI, financial, trade secrets, credentials — this drives notification requirements
  5. Preserve evidence — network captures, DLP alerts, proxy logs, endpoint forensics
  6. Legal notification — consult legal on breach notification obligations (GDPR 72 hours, state laws vary)
  7. Contain the source — identify and remediate the initial access vector that enabled the exfiltration
  8. Post-breach hardening — implement DLP controls, network segmentation, and enhanced monitoring

Related Resources

Log Management NIST Framework CVE Lookup Tool

Need Detailed IR Playbooks?

For comprehensive incident response procedures and templates:

Visit FixTheVuln.com →

FixTheVuln Store

Study Planners Available for Both Certs

Fillable PDF study planners with domain trackers, weekly schedules, and progress tracking. Available in Standard, ADHD-Friendly, Dark Mode, and 4-Format Bundle.

CompTIA CySA+ Planner GIAC GCIH Planner

60+ certifications available — from $5.99

FixTheVuln Store

Patch Tuesday Sprint Kit

5 fillable templates for vulnerability triage, sprint planning, testing, SLA tracking, and executive reporting. Free blank templates or $4.99/mo for pre-filled intelligence with real CISA KEV data.

Try Free Templates Subscribe — $4.99/mo

CyberFolio

Choosing your next cert? Track them all in one place.

Build a shareable cybersecurity portfolio that highlights your certifications, projects, and skills — free.

Build Your Portfolio →