Incident Response: the first hour

The first sixty minutes of a suspected incident set the tone for everything after. The goal is not to solve it — it is to stop the bleeding, protect the evidence, and get the right people talking. Work the three tracks below in parallel, not in sequence.

1. Contain

• Isolate affected hosts from the network, but do not power them off — you lose memory-resident evidence.
• Disable, don't delete, suspected compromised accounts; force a session revoke and password reset.
• Block known-bad indicators (IPs, domains, hashes) at the perimeter and endpoint where you can.
• Resist the urge to "clean up" — premature remediation destroys the trail.

2. Preserve

• Capture volatile data first: memory, running processes, network connections, logged-on users.
• Note timestamps and time zones for everything you observe.
• Snapshot rather than modify: export logs, take forensic images where warranted.
• Keep a running timeline — who did what, when, and what was seen.

3. Communicate

• Notify the incident lead and start a single source of truth for updates.
• Use out-of-band communication if you suspect email or chat is compromised.
• Loop in legal, leadership, and (if relevant) your cyber-insurer early — not after.
• Say what you know, what you don't, and what you're doing next. Avoid speculation in writing.

What to have ready beforehand

• An up-to-date contact list, including out-of-band channels.
• Pre-authorized authority to isolate hosts and disable accounts.
• Playbooks for your most likely scenarios (business email compromise, ransomware, payroll and vendor fraud).

This is a starting point, not a substitute for a plan tailored to your environment. If you want help building one, that's whatAegis Security Advisors does.