SANS Incident Handler's Handbook and PICERL Methodology
Containment

SANS Incident Handler's Handbook and PICERL Methodology PICERL-C-02: Containment: System Backup Before Remediation

Capture forensic images and volatile memory of compromised systems before applying remediation steps, with hashed and stored evidence for later analysis.

Maintained by Gerard BlokdykControl text last updated

Other controls in Containment

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll SANS Incident Handler's Handbook and PICERL Methodology controls