Incident Response Basics — Internal Knowledge Base

Incident response at our organization follows six phases adapted from the SANS
model: preparation, identification, containment, eradication, recovery, and
lessons learned. Preparation happens before any incident: contact lists,
runbooks, and logging must be in place. Identification means confirming that an
observed event is actually a security incident and classifying its severity.

Containment limits the damage. Short-term containment isolates affected
machines from the network — for example, disabling the switch port or using the
EDR tool's network-quarantine function. Long-term containment applies temporary
fixes so business can continue while eradication is planned. Never power off a
machine that may hold volatile evidence unless the runbook explicitly says so.

Eradication removes the attacker's foothold: malware is deleted, compromised
accounts are disabled and re-credentialed, and vulnerable software is patched.
Recovery restores systems to production with heightened monitoring, typically
for at least two weeks. The lessons-learned meeting must happen within ten
business days of closing an incident, and its report feeds back into the
preparation phase.

Severity levels: SEV-1 (active data loss or ransomware, page the on-call
immediately), SEV-2 (confirmed compromise, contained), SEV-3 (suspicious
activity under investigation). All SEV-1 and SEV-2 incidents require executive
notification within four hours.
