Investigation Playbooks
Select an incident type to view step-by-step response procedures organized by lifecycle stage.
Ransomware
Encryption-based extortion attack targeting files, databases, or entire systems with ransom demands for decryption keys.
Phishing
Social engineering attack delivered via email, SMS, or messaging platforms designed to harvest credentials or deliver malicious payloads.
Data Exfiltration
Unauthorized transfer of sensitive data outside the organization through network channels, cloud services, or removable media.
Insider Threat
Malicious or negligent activity by an authorized user, employee, contractor, or business partner that compromises data or systems.
Web Application Compromise
Exploitation of web application vulnerabilities such as injection flaws, authentication bypasses, or server-side request forgery leading to unauthorized access.
Cloud & Identity Compromise
Unauthorized access to cloud infrastructure or identity provider through stolen tokens, OAuth abuse, or misconfigured access policies.
Business Email Compromise
Targeted attack leveraging compromised or spoofed executive email accounts to authorize fraudulent transactions or redirect sensitive communications.
Credential Theft
Theft of authentication credentials through brute force, credential stuffing, keylogging, LSASS dumping, or password database compromise.