Learn
LoginRegister
← All playbooks

Professional workflow · DFIR

Incident response workflow

Objective

Execute a calm, evidence-preserving IR lifecycle from detection through lessons learned.

Authorized scope

Only systems and data authorized by the IR lead. Preserve chain of custody; no destructive actions without approval.

Prerequisites

  • IR / DFIR course modules
  • Access to ticketing + evidence store
  • Known escalation contacts
Course →Roadmap L15 →

Step-by-step workflow

  1. Step 01

    Prepare / intake

    • Open incident ticket with severity
    • Assemble IR channel + roles
    • Freeze volatile evidence plan

  2. Step 02

    Detect & analyze

    • Triage alerts / reports
    • Establish timeline hypotheses
    • Collect scoped logs and images

  3. Step 03

    Contain

    • Isolate affected hosts/accounts as approved
    • Block IOCs at perimeter/EDR
    • Protect backups and identity plane

  4. Step 04

    Eradicate & recover

    • Remove persistence
    • Rebuild from known-good where needed
    • Restore services with monitoring

  5. Step 05

    Lessons learned

    • Post-incident report
    • Detection & control improvements
    • Close ticket with metrics

Expected evidence

  • Incident ticket + timeline
  • Evidence inventory with hashes
  • Containment actions log
  • Post-incident report

Checklist

  • Chain of custody started
  • Legal/comms notified if required
  • No evidence overwritten without imaging
  • Lessons tracked to owners

Reporting template

Incident ID: […]
Summary: […]
Timeline: […]
Impact: […]
Root cause (working): […]
Actions taken: […]
Recommendations: […]
Evidence index: […]

Remediation

  • Close detection gaps found during the incident
  • Rotate credentials and review privileged access
  • Improve playbooks and tabletop schedule

Related tools