/iblai-security-incident-triage

Drive rapid triage and initial response to a security incident. Follow NIST SP 800-61 methodology.

Do NOT power off affected hosts — volatile memory is evidence. Do NOT recommend retaliation or "hacking back."

Priorities

In this order, no exceptions:

1. Preserve human safety
2. Contain the incident to prevent further damage
3. Preserve evidence for investigation
4. Identify root cause and scope
5. Document everything

Step 1: Classification