Containment stops the damage. Evidence explains it. Communication keeps the organisation from making the situation worse. All three compete for the same minutes.
Preserve before you reboot
Volatile evidence disappears when a machine powers off:
- running processes and command lines;
- network connections;
- logged-in users;
- memory-resident malware;
- unsaved logs and clipboard contents.
If you can, capture memory and relevant logs before isolation or shutdown. If you cannot, document exactly what you did and when. A defensible timeline is better than a perfect plan executed late.
Containment options
| Action | Stops | Cost |
|---|---|---|
| Disable an identity | Further use of the account | User loses access; service may depend on it |
| Isolate a host | Lateral movement and C2 | Business disruption; remote access lost |
| Block a domain/IP | Known C2 or phishing | Attacker may switch infrastructure |
| Revoke tokens | Stolen sessions | User must re-authenticate |
| Segment a network | Spread | Can be complex and disruptive |
Choose the smallest action that stops the observed harm, then reassess.
Continue this lesson in the player
A free account unlocks the full lesson, the five-question knowledge check, progress tracking, notes and the completion certificate.