---
title: "Keep a security incident runbook and · Agent Wranglers"
url: https://agentwranglers.se/playbook/application-security/errors-logs-and-vulnerabilities/security-incident-runbook
id: APS-108
level: Recommended
updated: 2026-10-27
build: a2a6bdfed830
tokens: 948
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Keep a security incident runbook and rehearse it

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Errors, logs and vulnerabilities](https://agentwranglers.se/playbook/application-security/errors-logs-and-vulnerabilities.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27.

- ID: APS-108
- Level: Recommended
- Chapter: [Errors, logs and vulnerabilities](https://agentwranglers.se/playbook/application-security/errors-logs-and-vulnerabilities.md)
- Rule: Keep a runbook for a security breach with scripts that revoke every session, rotate every secret and preserve logs. Run it as a drill on staging at least every 12 months.
- Check: The last drill is under 12 months old. In it, every session token issued before the drill answered 401 within 15 minutes of the revoke script. Every rotated secret's old value was refused, and the preserved logs cover the 24 hours before the drill.
- How: In a breach, the first hour decides how much leaks. Write the steps in order. Declare the incident as [Declare incidents early](https://agentwranglers.se/playbook/operations/incidents/declare-incidents.md) says, and copy logs before anything changes, as [Keep evidence in security incidents](https://agentwranglers.se/playbook/operations/incidents/security-incidents.md) says. Then revoke sessions and tokens, rotate keys and passwords from the secret list, and block the way in. Start the legal clocks from [Plan for a data breach](https://agentwranglers.se/playbook/compliance/breaches-and-reporting/breach-plan.md). Keep each step as a script that one person can run, since a page of manual steps fails under stress. Note the drill time and every step that failed.

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### JavaScript example

```js
export async function revokeAllSessions(db, now = new Date()) {
  await db.query('UPDATE sessions SET revoked_at = $1 WHERE revoked_at IS NULL', [now]);
  await db.query('UPDATE settings SET tokens_valid_after = $1', [now]);
}
```

### Python example

```python
def revoke_all_sessions(db, now):
    db.execute("UPDATE sessions SET revoked_at = %s WHERE revoked_at IS NULL", (now,))
    db.execute("UPDATE settings SET tokens_valid_after = %s", (now,))
```

## Sources

- [NIST SP 800-61 Rev. 3 Incident Response Recommendations](https://csrc.nist.gov/pubs/sp/800/61/r3/final)

## Related rules

- OPS-25 [Declare incidents early](https://agentwranglers.se/playbook/operations/incidents/declare-incidents.md) in Operations and observability
- OPS-30 [Keep evidence in security incidents](https://agentwranglers.se/playbook/operations/incidents/security-incidents.md) in Operations and observability
- CMP-71 [Plan for a data breach](https://agentwranglers.se/playbook/compliance/breaches-and-reporting/breach-plan.md) in Compliance and governance

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/application-security/errors-logs-and-vulnerabilities/security-incident-runbook">Agent Wranglers application security playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Publish a vulnerability disclosure policy](https://agentwranglers.se/playbook/application-security/errors-logs-and-vulnerabilities/disclosure-policy.md)
- [Errors, logs and vulnerabilities](https://agentwranglers.se/playbook/application-security/errors-logs-and-vulnerabilities.md)