Containment Planning
IT IT Ops
The prompt
Plan containment and eradication to stop attacker access and remove persistence mechanisms.
Why this works
Rapid containment stops the attacker and limits damage. Eradication removes persistence to prevent re-compromise.
Risks & review
Containment actions may alert attacker. Incomplete eradication allows attacker to re-establish access.