containment

Incident Containment Strategies -- NIST SP 800-61 Rev 2 / MITRE ATT&CK

Frameworks: NIST SP 800-61 Rev 2 (Containment, Eradication, and Recovery), MITRE ATT&CK Enterprise Matrix Role: SOC Analyst, Security Engineer Time: 15-30 min Output: Containment plan with short-term and long-term actions, business impact trade-off analysis, ATT&CK-mapped countermeasures, and rollback criteria

---

1. When to Use

If a target is provided via arguments, focus the review on: $ARGUMENTS

Invoke this skill when any of the following conditions are met:

• Active incident requires isolation -- A confirmed security incident is in progress and affected systems must be contained to prevent further damage or lateral movement.
• Containment strategy selection -- The responder needs to choose between network isolation, credential revocation, DNS sinkholing, or other containment mechanisms based on incident type and business constraints.
• Business impact vs. security risk trade-off -- The containment action may disrupt business operations and the team needs a structured framework to evaluate the trade-off.
• Attacker technique requires specific countermeasure -- The identified ATT&CK technique dictates a particular containment approach (e.g., credential theft requires credential revocation, not just network isolation).
• Containment effectiveness validation -- Previous containment actions may have been insufficient and the team needs to assess and escalate containment measures.

Do not use when: The task is initial incident triage and classification (use ir-playbook), forensic evidence collection (use forensics-checklist), or post-incident review (use post-incident-review).

---

2. Context the Agent Needs

Before selecting a containment strategy, gather or confirm:

• Incident classification and severity -- From the ir-playbook assessment (category, SEV level).
• Affected systems inventory -- Hostnames, IPs, cloud resource IDs, services running on affected systems, and their business function.
• Attack vector and techniques -- Known MITRE ATT&CK techniques in use (initial access, lateral movement, persistence, C2).
• Attacker access scope -- What accounts, systems, and network segments has the attacker accessed or potentially compromised?
• Business criticality of affected systems -- Revenue impact, customer impact, SLA obligations, regulatory implications of downtime.
• Network topology -- VLANs, subnets, firewall zones, cloud VPCs, segmentation boundaries relevant to the affected systems.
• Evidence preservation status -- Has volatile evidence been captured? (Reference forensics-checklist.) Containment actions may destroy evidence if not collected first.
• Current containment state -- What actions, if any, have already been taken?