Endpoint Incident Response & Forensics Playbook
You see a high-severity EDR detection, an elevated account used off-hours, or rapid file modifications on a user laptop. The SOC is noisy, the desktop owner is anxious, and the evidence you need — process memory, live network sockets, volatile handles — degrades with every reboot, VPN drop, or cloud autoscale event. The real problem is not that you lack tools; it's that the first responders often…
When facing a high-severity EDR detection or rapid file modifications on a user laptop, the SOC can become noisy and the evidence needed for investigation may degrade quickly. The real challenge lies not in the lack of tools, but rather that first responders often prioritize speed over preservation, potentially destroying critical artifacts that could prove scope and root cause.
The most effective approach is to follow a repeatable remote-triage loop, confirming the alert against asset inventory, recent change windows, and identity logs. Quickly scope the incident by determining the role of the affected host, its network segment, and service dependencies. Preserve the blast radius by stopping lateral movement vectors first, such as credential reuse, open remote sessions, and file shares.
The first 0-10 minute triage checklist includes querying the EDR for detection details, fetching short-lived telemetry like process tree, network connections, loaded modules, active logon sessions, and open sockets. Record response IDs, timestamps (in UTC), and operator names in the incident ticket. Run commands remotely or via EDR live response, such as exporting process information, network connections, and system/event logs to CSV or XML files.
When containing the incident, use surgical containment rather than binary. Employ EDR's tools to isolate the host, quarantine files/processes, and apply selective network exceptions. Prefer EDR isolate actions over blunt network switches, as this preserves agent telemetry and remote management channels. Document the containment scope, including IPs, processes, and exclusion rules applied.
In Windows environments, collect volatile artifacts immediately by saving registry hives, exporting event logs, and computing file hashes. In Linux environments, focus on saving registry hives, exporting system and security event logs, and generating file hashes. Respect the volatility order, collecting the most ephemeral evidence first to maximize recoverable evidence.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
