Document Incident Activity
Create a timeline of events including:
- when suspicious activity was discovered
- affected systems
- impacted accounts
- unusual emails
- alerts
- ransom notes
- suspicious logins
Save
- screenshots
- timestamps
- user reports
- communications
Accurate timelines help reduce investigative delays and support faster recovery decisions.
Preserve Critical Evidence
Preserve:
- email artifacts
- firewall logs
- endpoint logs
- cloud logs
- screenshots
- malicious files
- suspicious messages
Do Not Delete:
- logs
- inboxes
- files
- backups
Evidence loss can make it harder to identify root cause and scope.
Avoid Actions That Create More Risk
Do Not:
- reimage systems
- wipe devices
- reset every password at once
- restore backups without validation
- shut systems down without documentation
Do Not Delete:
- logs
- inboxes
- files
- backups
Uncoordinated recovery efforts often create secondary incidents.
Limit Additional Exposure
If systems are actively spreading malware or attackers maintain active access:
- isolate affected systems
- disconnect compromised accounts
- restrict unnecessary access
Contain carefully without destroying evidence.
If you haven't already,
Contact Red Orb to help perform containment validation, recovery oversight, or incident analysis,