📤

Data Exfiltration

Unauthorized transfer of sensitive data outside the organization through network channels, cloud services, or removable media.

24 runbook nodes8 lifecycle stages covered

Triage

(3 nodes)

Bound the Investigation Timeframe

Timeframe Bounding

30min

View node

Identify Patient Zero (First Compromised System)

Patient Zero

60min

View node

Validate the Initial Access Vector

Access Validation

45min

View node

Containment

(3 nodes)

Network Isolation of Compromised Systems

Network Isolation

30min

View node

Credential and Account Lockdown

Account Lockdown

45min

View node

Block Active Exfiltration Pathways

Block Exfiltration

30min

View node

Preservation

(4 nodes)

Volatile Memory Capture

Memory Capture

60min

View node

Log Preservation and Snapshot

Log Snapshot

45min

View node

Document Chain of Custody for All Collected Evidence

Chain of Custody

30min

View node

Covert Evidence Capture for Insider Threat

Insider Evidence Capture

120min

View node

Collection

(5 nodes)

EDR Telemetry Collection

EDR Collection

120min

View node

M365 Unified Audit Log Collection

M365 UAL Collection

90min

View node

Collect DLP Policy Alerts and Hits

DLP Alerts

45min

View node

Identify Alternative Evidence When Primary Logs Are Missing

Missing Log Fallback

60min

View node

Coordinate Log Collection from Third-Party Vendors

Third-Party Logs

120min

View node

Analysis

(3 nodes)

Lateral Movement Analysis and Mapping

Lateral Movement

120min

View node

Map Exfiltration Channels (HTTP, DNS, Cloud Sync)

Exfil Channels

90min

View node

Identify Data Staging and Compression Activity

Data Staging

60min

View node

Eradication

(2 nodes)

Eradication Verification Checklist

Eradication Verification

90min

View node

Post-Incident Configuration Hardening

Config Hardening

180min

View node

Recovery

(1 node)

Phased Service Restoration with Enhanced Monitoring

Service Restoration

120min

View node

Post-Incident Review

(3 nodes)

Create New Detection Rules Based on Incident Findings

Detection Improvement

90min

View node

Generate Comprehensive Incident Report

Incident Report

180min

View node

Conduct Lessons Learned Review Session

Lessons Learned

120min

View node