2 min readAn original planning guide. Use the linked primary documentation for platform details and the supported procedure for your environment.
Record what was observed
Capture the affected URL or system, time and timezone, exact symptom, and how it was discovered. Separate observations from assumptions.
Identify immediate impact
Note affected users, suspicious changes, and critical services. Involve the authorized response owner promptly when exposure or active harm is suspected.
Preserve appropriate evidence
Retain relevant logs, screenshots, and change history through approved channels. Avoid posting private data, access tokens, or unreviewed malicious files.
Track authorized actions
Record containment and recovery decisions, who made them, and their outcomes. Use the responsible team's process rather than improvising destructive cleanup.
Worked scenario
See the plan in practice.
A visitor reports a redirect seen only on mobile. Preserve the exact path and circumstances before several unrecorded changes erase useful context.
Review your result
Your acceptance checklist
Timeline started- Owner involved
- Evidence controlled
Use these checks to identify gaps in your incident intake note. Assign an owner to any unresolved item before the next dependent step.
The terms behind the task
- Incident responseA coordinated process for assessing, containing, investigating, and recovering from a suspected security incident.
- MalwareSoftware intentionally designed to compromise, disrupt, exploit, or otherwise misuse systems or data.
- MonitoringThe ongoing collection and evaluation of signals used to understand a system's condition and detect problems.
Primary references
For the underlying concepts and current platform details:
