Containing an Active Security Breach

When to Use

• Active unauthorized access detected on network or systems
• IDS/IPS alerts indicate ongoing exploitation or data exfiltration
• SOC analysts confirm a true positive security incident requiring immediate containment
• Lateral movement or privilege escalation observed in real time
• Ransomware encryption activity detected before full deployment

Prerequisites

• Incident Response Plan with defined containment procedures
• Network access to firewalls, switches, and endpoint management consoles
• EDR/XDR platform deployed across endpoints (CrowdStrike, SentinelOne, Microsoft Defender for Endpoint)
• SIEM access with real-time log correlation (Splunk, Elastic, QRadar)
• Pre-approved authority to isolate systems (documented in IR plan)
• Forensic imaging tools ready for evidence preservation

Workflow