Agent WranglersIncidents Required
Keep evidence in security incidents
When an incident may be an attack or a data leak, keep evidence before you clean up, and know who you must tell.
How to do it
Follow a written plan, such as one based on NIST SP 800-61 Rev. 3. Snapshot disks and copy logs before you rebuild a machine. Rotate keys the attacker may have seen. Note the legal deadlines for reporting a breach, such as 72 hours under the GDPR. The breach plan covers telling the authority and the people affected.
How to check
The security plan names who decides, who to notify and their deadlines. The last security drill or incident record shows that logs and a disk snapshot were saved before cleanup.
For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers operations playbook: https://agentwranglers.se/playbook/operations/incidents/security-incidents.