IncidentResponsev2

3 - Containment Phase

This section contains the following playbooks and procedures:

• 3.01_Export_users_from_Active_Directory
• 3.02_Export_groups_from_Active_Directory
• 3.03_Export_Group_Policy_Objects_from_Active_Directory
• 3.04_Export_Trust_relationships_from_Active_Directory
• 3.05_Export_OU_Structure_from_Active_Directory
• 3.06_Monitor_AD_New_Account_Creation
• 3.07_Create_team_admin_account_in_AD
• 3.08_Change_Domain_Administrator_account
• 3.09_Disable_Domain_Administrator_password
• 3.10_Change_or_disable_Workstation_local_Administrators
• 3.11_Verify_patch_compliance_on_all_hosts
• 3.12_Enforce_Group_Policy
• 3.13_Restrict_Non-IR_Personnel_Access
• 3.14_Block_External_Communication
• 3.15_Disable_Scheduled_Jobs_and_Tasks
• 3.16_Disble_Windows_Services
• 3.17_Remove_Unapproved_Software_and_Tools
• 3.18_Verify_Containment_is_Successful
• 3.20_Conduct_Containment_Outbrief
• 3.20_Document_Containment_Actions
• 3.21_Finalize_Containment_Documentation

Select the links above to access the specific procedures and details for this phase.