Incident Response

Automate phishing report button triage with SOAR to classify emails and extract IOCs

Write a ransomware playbook aligned with CISA StopRansomware and NIST CSF

Write a SOC ransomware playbook with SIEM queries, isolation steps and decision trees

Generate forensic super-timelines with Plaso and triage the results in Timesketch

Collect, classify and share indicators of compromise in STIX and TAXII formats

Collect volatile evidence from a compromised host before it is isolated or wiped

Contain and investigate incidents in AWS, Azure and GCP using cloud-native audit logs

Respond to malware infections across endpoints with containment and eradication steps

Analyze RAM dumps with Volatility 3 to spot injection, C2 links and credential theft

Investigate phishing by analyzing reported emails, sandboxing links and purging messages

Run structured post-incident reviews to find root causes and set follow-up actions

Contain an active breach with isolation, credential revocation and access changes

Find hidden processes, hooked syscalls and covert connections that point to rootkits

Remove malware and persistence from Windows and Linux hosts without reinfection

Pull browser history, cookies and downloads from Chrome, Firefox and Edge for forensics

Recover password hashes, Kerberos tickets and tokens from Windows memory dumps

Spot hollowed processes and injected code in memory images with Rekall plugins

Parse EVTX logs with Chainsaw, Hayabusa and EvtxECmd to spot attacker activity

Turn EVTX files into prioritized timelines with Hayabusa, Sigma rules and MITRE tags

Hunt EVTX files with Chainsaw using Sigma rules, keyword search and shimcache analysis

Spot timestomped files by comparing MFT $STANDARD_INFORMATION and $FILE_NAME timestamps

Sweep Windows for run keys, services, tasks and WMI persistence during incident response

Classify and correlate intrusions with the four-part Diamond Model

Back up with restic to S3 Object Lock so ransomware cannot delete your copies

Write OT incident playbooks that classify safety, process and access events

Plan ransomware backups with 3-2-1-1-0 copies, immutable storage and restore tests

Automate alert triage and containment with Splunk SOAR playbooks

Create Splunk SOAR containers and phishing playbooks through the REST API

Build Cortex XSOAR playbooks for phishing, malware and account compromise response

Link SIEM alerts to ServiceNow, Jira or TheHive tickets with SLA and escalation rules

Collect forensic artifacts across Windows, Linux and macOS with Velociraptor VQL packs

Investigate phishing emails from header analysis to URL detonation and containment

Preserve memory and disk, collect ransom notes and identify the ransomware variant

Parse MFT, Prefetch, registry and Amcache artifacts with the EZ Tools suite

Trace AD compromise via auth logs, replication metadata and Kerberos anomalies

Snapshot cloud volumes and preserve native logs for AWS, Azure and GCP breach cases

Rebuild attacker timelines from CloudTrail with LookupEvents or Athena queries

Revoke compromised cloud credentials and isolate resources in AWS, Azure and GCP

Query CloudTrail and VPC Flow Logs in Athena to trace data theft and lateral movement

Acquire cloud storage evidence from Google Drive, OneDrive, Dropbox and Box

Image disks and rebuild timelines with FTK Imager, Autopsy and The Sleuth Kit

Image endpoint memory and disks to rebuild the scope of a compromise

Carve deleted files from raw disk images with Foremost header and footer signatures

Build evidence-based insider threat cases with forensics and HR and legal coordination

Reconstruct Linux sessions from auth.log, journalctl and auditd for forensic timelines

Parse and correlate system and security logs to rebuild events and timelines

Sweep Windows and Linux for every persistence mechanism malware uses to survive reboots

Pull processes, network links and keys from RAM dumps with Volatility 3 plugins

Hunt injected code and rootkits in Windows, Linux and macOS memory images