Knowledge base / Playbooks
Short, decision-oriented response plans designed to be used under pressure, with owners, evidence, containment, and exit criteria.
An administrative Windows password reset can restore sign-in while breaking access to DPAPI-protected secrets, EFS files and private keys. Learn how to identify the account type, preserve a working session, back up recovery material and prove the data still opens.
Combine code review, safe staging tests, structured application events, web telemetry and endpoint evidence to find injection flaws and investigate attempted exploitation.
A role-based cloud identity response checklist from declaration through session revocation, evidence, persistence review, lockout recovery, and monitoring.
Coordinate business continuity, isolation, evidence, identity protection, external obligations, and clean recovery.
Triage the message, interaction, identity, endpoint, and recipient scope without detonating the lure or deleting the only evidence.
Capture the application and grant, disable access, find affected data and users, and prevent the same consent path from recurring.
Use device state, encryption, data classification, identity, remote management, and legal requirements to choose proportionate action.
Replace and revoke the secret, but also establish exposure time, permissions, use, copies, dependencies, and newly created persistence.
Protect availability while preserving web, identity, process, file, network, deployment, and cloud evidence.
Separate malicious traffic, flash demand, dependency failure, and capacity exhaustion while keeping communication and evidence intact.
Coordinate legal, HR, privacy, identity, endpoint, and data evidence without tipping off the subject or exceeding authorised monitoring.
Turn a supplier notification into an inventory, access, data, continuity, and evidence response for your own organisation.