Security Incident Response Guide
A streamlined framework for identifying, containing, and resolving cybersecurity incidents—fast.
📒 What’s This For?
This guide helps security, IT, and engineering teams respond to incidents quickly and consistently. It outlines key phases, actions, and tools needed to reduce damage and restore operations.
⚡ Phase 1: Identify
Goal: Spot and confirm the incident.
Do this:
Review alerts from SIEM, EDR, firewalls
Look for unusual behavior (traffic, access patterns, system logs)
Confirm if it’s real—false positives happen
Tag the incident type: malware, phishing, data breach, etc.
Log affected assets, users, and initial blast radius
Use:SIEM dashboards, EDR logs, IDS/IPS alerts
🚧 Phase 2: Contain
Goal: Stop the spread.
Do this:
Cut network access for compromised endpoints
Disable breached accounts or services
Block suspicious IPs/domains at the firewall
Capture forensic images for later analysis
Use:EDR tools, firewall rules, network segmentation controls
🧹 Phase 3: Eradicate
Goal: Remove the threat fully.
Do this:
Clean out malware or malicious code
Patch exploited vulnerabilities
Reset passwords and enforce MFA
Double-check for persistence or backdoors
Use:AV/EDR, patch systems, vulnerability scanners
🔁 Phase 4: Recover
Goal: Restore clean systems and monitor.
Do this:
Rebuild or restore from verified backups
Apply hardening (disable unused ports, tighten roles, etc.)
Monitor for lingering threats or recurrence
Use:Backup/recovery tools, hardened images, SIEM
🧠 Phase 5: Learn
Goal: Capture insights. Improve next time.
Do this:
Hold a debrief (cross-functional if needed)
Document what worked, what didn’t
Update response runbooks and detection rules
Train the team on changes
Use:Incident report template, security knowledge base, internal LMS
📂 Incident Summary Template
Incident Name:Date & Time:Type: (e.g., Phishing, Ransomware)Systems/Users Affected:Containment Actions:Eradication Steps:Recovery Measures:Follow-Up Recommendations:
