📤 Data Exfiltration
Unauthorized transfer of sensitive data outside the organization through network channels, cloud services, or removable media.
24 procedures8 lifecycle stages
Triage
(3 procedures)Containment
(3 procedures)Network Isolation of Compromised Systems
Network Isolation
30min
View procedure
Credential and Account Lockdown
Account Lockdown
45min
View procedure
Block Active Exfiltration Pathways
Block Exfiltration
30min
View procedure
Sponsored
Preservation
(4 procedures)Volatile Memory Capture
Memory Capture
60min
View procedure
Log Preservation and Snapshot
Log Snapshot
45min
View procedure
Document Chain of Custody for All Collected Evidence
Chain of Custody
30min
View procedure
Covert Evidence Capture for Insider Threat
Insider Evidence Capture
120min
View procedure
Collection
(5 procedures)EDR Telemetry Collection
EDR Collection
120min
View procedure
M365 Unified Audit Log Collection
M365 UAL Collection
90min
View procedure
Collect DLP Policy Alerts and Hits
DLP Alerts
45min
View procedure
Identify Alternative Evidence When Primary Logs Are Missing
Missing Log Fallback
60min
View procedure
Coordinate Log Collection from Third-Party Vendors
Third-Party Logs
120min
View procedure