Choose incident-response actions that preserve evidence while reducing privileged-account risk.
Security event Global Admin login at 1:14 a.m. from unexpected geography; impossible-travel score is high; no approved change is scheduled. Privileged sessions can modify identity, email, and endpoint controls within minutes. Decision walk Preserve, contain, scope Incident response works when containment and evidence move together. Shortcut Act on the loudest theory first A bounded first move 01 Preserve 02 Contain 03 Scope Node 1 The login is credible, but the admin may be asleep and unreachable. What should happen before broad cleanup?
Sign up free — one personalized lesson every day, matched to your role and goals.
Already have an account? Sign in