What should be preserved after containment?¶

After containment, preserve the evidence needed to compare the original incident state with the changed environment.

Avoid this assumption: Once the harmful activity stops, the urgent preservation work is complete. Containment itself may create valuable records and may also hide or remove earlier evidence.

Record the exact time each system, account, interface or service was contained.

Capture the post-action screen, alerts, session state, network state, logged-in users and service availability.

Preserve incident-response logs, firewall changes, account-security events, process termination records, isolation records and provider confirmations.

Record which connections ended, which remained and whether new routes appeared.

Preserve any attacker response, including failed logins, new accounts, deletion, movement to another system or attempts to reconnect.

Record files, logs or systems that became inaccessible or changed during the action.

Preserve central logs, cloud audit records and provider-held data that may show the transition.

Document any service restoration, temporary workaround or account transfer introduced after containment.

Do not overwrite the original evidence with post-containment exports or screenshots.

Keep before-and-after records clearly separated and time-labelled.

Review whether volatile evidence remains on isolated systems and whether specialist acquisition is still required.

Record any uncertainty about what the action changed.

Do not assume the absence of further alerts proves the threat has been removed.

Preserve any evidence that containment failed, was partial or produced a new problem, including repeated alerts, reconnect attempts or unexpected service behaviour.

Operational takeaway¶

Preserve the complete post-containment state and all responder-created records, keeping them separate from the original evidence so changes, losses and attacker reactions can be assessed.