SANS Incident Handler's Handbook and PICERL Methodology
Phase 3: Containment – SANS Incident Handler's Handbook and PICERL Methodology

SANS Incident Handler's Handbook and PICERL Methodology C-3: C-3 Long-term containment: temporary fixes to keep production running while clean systems are rebuilt

Where affected systems must stay in production, the team applies temporary fixes while clean replacements are built: removing accounts and backdoors left by the attacker, patching affected and neighbouring systems, and other work limiting escalation while business continues; if a system can go offline the team moves straight to eradication.

Maintained by Gerard BlokdykControl text last updated

Other controls in Phase 3: Containment – SANS Incident Handler's Handbook and PICERL Methodology

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll SANS Incident Handler's Handbook and PICERL Methodology controls