Please enable JavaScript.
Coggle requires JavaScript to display documents.
3️⃣ Containment Phase (Stop Damage + Control Incident) - Coggle Diagram
3️⃣ Containment Phase (Stop Damage + Control Incident)
1️⃣ What is Containment?
Definition
Containment is the process of limiting an attacker's access,
stopping further damage, and preventing the attacker from
moving to other systems.
Main Goal
Stop attacker activity
Protect critical systems
Preserve evidence
Prevent lateral movement
Maintain business operation
Types of Containment
Short-Term Containment
Immediate actions during active attack
Examples:
Block attacker IP address
Disable compromised account
Stop malicious process
Isolate infected server
Long-Term Containment
Secure environment until complete recovery
Examples:
Apply security patches
Reset credentials
Improve firewall rules
Harden Linux configuration
2️⃣ Enterprise Incident Response Preparation
Required Tools
SIEM
Security Information and Event Management
Purpose:
Collect Linux logs
Detect attacks
Create alerts
Investigate incidents
Examples:
Elastic SIEM
Splunk
QRadar
EDR
Endpoint Detection and Response
Purpose:
Monitor processes
Detect malware
Isolate endpoint
Firewall
firewalld
nftables
iptables
Linux Security Tools
auditd
AIDE
OSSEC
Falco
SELinux
3️⃣ First Step of Containment
Identify Compromised Asset
Before containment answer:
Which Linux server is compromised?
Which user account is affected?
Which process is malicious?
Which IP address belongs to attacker?
What data is affected?
Is attacker still active?
4️⃣ Collect Initial Information Before Blocking
Check Logged In Users
Command:
who
Shows:
Username
Terminal
Login time
Check Active Sessions
Command:
w
Shows:
Logged users
Source IP
Running activity
Check Network Connections
Command:
ss -tunap
Explanation:
s = socket information
t = TCP
u = UDP
n = show numbers
a = all connections
p = process name
Find Suspicious Process
Commands:
ps aux
top
htop
Check:
High CPU process
Unknown binaries
Strange users
5️⃣ Short-Term Containment Actions
A️⃣ Isolate Linux Server
Purpose:
Stop attacker communication
Method 1:
Disable Network Interface
Command:
ip link set eth0 down
Method 2:
Block Network Traffic
Firewall:
firewall-cmd --add-rich-rule='rule family="ipv4" source address="ATTACKER_IP" drop'
B️⃣ Block Attacker IP
Check attacker IP:
last
Add firewall block:
firewall-cmd --permanent \
--add-rich-rule='rule family="ipv4" source address="192.168.1.50" reject'
Reload:
firewall-cmd --reload
C️⃣ Disable Compromised User Account
Example:
Attacker user:
hacker01
Lock account:
passwd -l hacker01
Check:
passwd -S hacker01
D️⃣ Kill Malicious Process
Find process:
ps aux | grep malware
Kill:
kill -9 PID
E️⃣ Stop Malicious Services
Check services:
systemctl list-units --type=service
Stop:
systemctl stop malicious.service
6️⃣ Preserve Evidence Before Cleanup
Important Rule
Never delete attacker files before collecting evidence
Create Evidence Directory
mkdir /incident_response
Copy Logs
cp /var/log/auth.log /incident_response/
cp /var/log/secure /incident_response/
Capture Running Processes
ps aux > /incident_response/processes.txt
Capture Network Status
ss -tunap > /incident_response/network.txt
7️⃣ Linux Log Locations During Containment
Authentication Logs
RHEL/CentOS:
/var/log/secure
Ubuntu:
/var/log/auth.log
System Logs
/var/log/messages
/var/log/syslog
Audit Logs
/var/log/audit/audit.log
8️⃣ Enterprise Containment Workflow
1️⃣ Alert Received From SIEM
2️⃣ Validate Incident
3️⃣ Identify Affected Server
4️⃣ Collect Volatile Evidence
5️⃣ Isolate Host
6️⃣ Block Attacker Communication
7️⃣ Disable Accounts
8️⃣ Stop Malicious Processes
9️⃣ Preserve Evidence
🔟 Document Every Action
9️⃣ Enterprise Documentation
Incident Ticket Contains:
Incident ID
Date and Time
Affected Hostname
IP Address
Attacker Indicators
Commands Executed
Evidence Location
Containment Actions
Analyst Name