Choose containment timing based on confidence, spread risk, evidence value, and business impact.
The tradeoff The host matters to production support, but the network pattern looks like external control. Contain too late and impact grows; contain too early and the business stops trusting SOC judgment. The threshold Confidence + spread risk + evidence value + business impact Containment is a risk decision with an explicit trigger. reflex isolate everything suspicious A containment trigger the team can execute. Containment decisions are strongest when the next trigger is named before pressure rises. Low confidence Step 1 One beacon-like connection appears from a noncritical workstation, no repeat, no payload. What is the stronger move? Sensitive host…
Sign up free — one personalized lesson every day, matched to your role and goals.
Already have an account? Sign in