Contain Security Incident

---
name: contain-security-incident
description: Contain an active or credible incident across hosts, identities, applications, cloud resources, networks, or data. Use when access, execution, exfiltration, fraud, destruction, or repeated compromise needs authorized interruption.
---

# Contain Security Incident

## Overview

Interrupt the validated path of harm with the smallest effective action, then verify the containment. Do not confuse a blocked symptom with eradication or recovery.

Read [references/containment-plan.md](references/containment-plan.md) before making disruptive changes.

## Workflow

1. Confirm incident lead, authority, current scope, harm path, critical services, evidence priorities, and emergency contacts.
2. Model containment choices.
   - Consider host/network isolation, process/service suspension, account disablement, session/token/key revocation, access-policy change, application feature disablement, route/rule changes, or provider controls.
   - Record expected harm reduction, operational impact, volatile evidence loss, dependencies, rollback, and attacker visibility.
3. Sequence actions.
   - Address active exfiltration/destruction/safety first, then privileged access, propagation, persistence, and re-entry paths.
   - Coordinate simultaneous identity, host, application, and network actions when staggered changes would alert or strand access.
4. Apply approved changes.
   - Record exact target, operator, time, command/control surface, result, failures, and unexpected effects.
5. Verify containment.
   - Check that the harmful path stopped, access/session state changed, affected services remain understood, and monitoring still functions.
6. Expand scope carefully.
   - Hunt for related indicators and access paths; update the incident record before new targets or actions.
7. Define exit criteria.
   - State what evidence permits eradication/recovery and what temporary controls must remain.

## Output

Return containment objective, options/tradeoffs, actions/results, verification, residual access, business impact, temporary controls, rollback, and next-phase criteria.