The first 30 minutes of an incident

The beginning of an incident is usually incomplete information under time pressure. Your first goal is to reduce uncertainty without destroying the evidence you need to understand what happened.

Establish a shared record

Assign an incident lead and a scribe. Record the trigger, the systems believed to be affected, and what is still unknown. Use UTC timestamps and distinguish observed facts from hypotheses.

2026-10-03T09:10:00Z | Observed | Alert on example-host-01
2026-10-03T09:13:00Z | Action   | Incident lead assigned
2026-10-03T09:16:00Z | Unknown  | Scope of account access

The timeline above is fictional. Keep real incident records in your organization’s approved system, with appropriate access controls.

Preserve before changing

Collect relevant alerts and logs using established procedures. Record their origin, collection time, and the person performing the collection. If forensic handling is required, follow your evidence preservation and chain-of-custody policy.

Avoid improvised commands on a potentially compromised host. Even a well-intentioned cleanup can change timestamps, remove artifacts, or alert an intruder.

Choose containment deliberately

Containment may include restricting an account, isolating a host, or blocking a specific route. Each option has a cost. Record the expected benefit, operational impact, authorization, and rollback conditions.

When there is ongoing harm, immediate containment may take priority over complete evidence collection. The incident lead should make that tradeoff with the relevant owners and record the reasoning.

Set the next checkpoint

Agree on the next update time, decision owner, and evidence needed. A concise handoff should answer:

1. What do we know?
2. What action has been taken?
3. What could still be affected?
4. What decision comes next?

After stabilization, turn missing telemetry and unclear responsibilities into improvements to the playbook. A response plan earns its value through rehearsals and revision.

Further reading: NIST incident response resources.