Four stages, one page
Whether it's an attack or an update that broke something, the first hour decides whether you find the cause quickly or lose the evidence.
0–10 minStabilise without destroying evidence
Record when you became aware, start an incident log, isolate a suspected compromised machine rather than switching it off, and hold off rebooting or reimaging until the evidence is safe.
10–30 minPreserve the evidence
Scan or snapshot the affected machines, export the Security, System, Application and PowerShell logs, note running processes and connections, and write everything to a separate disk.
30–60 minFind what changed
Check new or changed programs and DLLs, auto-starts, services and scheduled tasks, drivers, software and updates, settings, accounts and remote logons, cleared logs, faked timestamps, downloads and deleted files.
At 60 minDecide what happens next
Security incident or operational change? Is it still there? Who needs to know, including any regulator whose reporting clock may be running?
