it-security-response

Disable sign-in, revoke active sessions, and reset authentication methods, then investigate mailbox rules, application consents, and data access. Build a timeline across sign-in logs and audit events before declaring full scope, and verify recovery through monitoring.

Preserve the message with headers and URLs, then check whether the user clicked links or entered credentials. Review sign-in activity, sessions, forwarding rules, and other recipients of the same message before purging confirmed malicious content.

Containment options include disabling sign-in, isolating devices, purging malicious emails, disabling service principals, blocking network indicators, and suspending data sharing. Apply the narrowest effective action with documented approval, expected impact, and reversal conditions.

Yes, it works with user-provided or authorized exported data when live tools are unavailable. It records collection gaps and retention limits, uses alternate evidence sources, and avoids definitive conclusions that the available evidence cannot support.

An alert without corroborating evidence stays classified as needs investigation rather than an incident. The workflow separates observed evidence from detector hypotheses and analyst inference, and never attributes attackers or breaches without proof.