Triage, scoping and containment

The first hour is about two questions: how far has this gone, and what is the least damaging way to stop it? Answer them in the right order and keep the evidence intact.

EDR (CrowdStrike, Defender, SentinelOne)AWS CLI / cloud consolesSIEMnetwork isolation (VLAN, security groups)IdP admin consoleforensic snapshots

Triage questions

What is the alert, and is it true? Rule out a false positive quickly with a second data source.
What is affected: which hosts, identities, accounts, services and data?
When did it start? The first alert is rarely the first event; look backwards.
What does the attacker have now: credentials, persistence, a foothold in the cloud?
Is data leaving, and is the activity ongoing?
What is the business impact, and what severity does that imply?

Containment options

Choose the smallest action that stops the harm. Short-term containment buys time; long-term containment prepares a clean recovery.

Identity: reset credentials, revoke sessions and tokens, disable the account or access key, require re-authentication with a second factor.
Endpoint: network-isolate the host through the EDR (it stays powered on and reachable by your tools), rather than powering it off and losing memory.
Network: block known-bad addresses and domains, tighten egress, move the system to a quarantine segment.
Cloud: deny-all policy on the compromised role, quarantine on the instance, snapshot the volume before changes.
Application: disable the vulnerable feature or route with a rule while a fix is built.

Cloud example: contain a leaked access key

Contain first, preserve second, investigate third. The commands below deactivate the key, deny further actions and snapshot a suspect volume; adapt names and ids, and record every command in the incident timeline.

contain-leaked-key.shbash

# 1. stop the key from working (keep it; do not delete, you need it as evidence)
aws iam update-access-key --user-name build-bot --access-key-id AKIAEXAMPLEKEY --status Inactive

# 2. deny everything for the user while you investigate
aws iam attach-user-policy --user-name build-bot --policy-arn arn:aws:iam::aws:policy/AWSDenyAll

# 3. isolate a suspect instance with a security group that allows nothing
aws ec2 modify-instance-attribute --instance-id i-0abc123 --groups sg-0quarantine

# 4. preserve its disk before any cleanup
aws ec2 create-snapshot --volume-id vol-0abc123 --description "INC-2026-0142 evidence" \
  --tag-specifications 'ResourceType=snapshot,Tags=[{Key=incident,Value=INC-2026-0142}]'

Mistakes to avoid

Wiping or reimaging before taking evidence: you lose the answer to how they got in.
Containing only the host you found: the attacker has other footholds, so scope first or contain widely at once.
Resetting one password but leaving active sessions, tokens, API keys and mailbox rules in place.
Tipping off the attacker by changing things piecemeal over days; coordinate containment into one decisive window.
Forgetting to record who did what and when.

Security groupsecurity groupA stateful list of rules attached to an instance or network interface in the cloud: who can come in on which port, from which source. It works as a host firewall at the cloud level, and it fails open by default: if you forget to close a port, it stays open to 0.0.0.0/0.see in glossary →WAFweb application firewallAn edge filter that blocks known attack patterns in HTTP. It complements the code: it does not replace fixing the vulnerability, it only buys time.see in glossary →

connections on the map

The incident response lifecycleis carried out byTriage, scoping and containment
Log analysis and building a timelinescopesTriage, scoping and containment
Triage, scoping and containmentis specialised forRansomware response playbook
Triage, scoping and containmentpreserves evidence forDigital forensics fundamentals

updated on 14/10/2026 · sources to go deeper · report an error

in other domains

Cloud incident responsecloudsecthe same containment, applied to accounts and cloud resources