Incident response is the organized way a team detects, contains, investigates, and recovers when a security incident is underway.
It is a staffed process with roles and handoffs, not a single tool and not the list of clues that the investigation happens to find.
How it works
A usable plan names who may isolate a system, who talks to customers, and who keeps notes that will still make sense a week later.
Containment comes before a long hunt so the attacker cannot keep using the same access while the team writes a perfect timeline.
Recovery includes restoring clean systems, rotating secrets that may have been exposed, and recording what will change so the same path is harder next time.
The work ends with a review that improves the plan, which is different from simply closing the ticket and hoping the noise stops.
Concrete examples
- A hosting team disconnects a web server from the internal network after ransomware notes appear, then restores from a backup that predates the encryption.
- A bank freezes a set of employee remote logins, resets those credentials, and only then walks the logs to see which records were opened.
- After a mailbox is used to send fraudulent invoices, the response lead notifies finance, preserves the mailbox, and blocks the forwarding rule that was added.
Protective measures
- Write the response roles before an incident, including who may take a system offline and who speaks externally.
- Keep an out of band contact list so a compromised mail system is not your only way to reach the team.
- Preserve logs and disk images that the investigation will need, and stop routine cleanup jobs from deleting them.
- Hold a short review after each serious incident and assign the changes while the details are still fresh.
Related articles
The observable traces an investigation looks for are catalogued in What are indicators of compromise during an intrusion investigation?.
Harm that starts from a person who already has access is discussed in What is an insider threat inside a trusted organization?.
A control that raises alerts without blocking traffic is explained in What is an intrusion detection system that alerts without blocking?.