Most of what goes wrong in incident response goes wrong in the first hour, and almost none of it involves sophisticated attacker tradecraft. It involves a well-meaning administrator rebooting the affected machine, an analyst deleting the malicious file, or someone emailing the whole company to say the network has been breached — on the mail system the intruder is reading.
What follows is not a compliance document. It is what actually needs to happen between the moment something looks wrong and the moment you have a defensible grip on the situation.
Where the first hour fits
The NIST incident-handling lifecycle divides the work into preparation; detection and analysis; containment, eradication and recovery; and post-incident activity. The first hour lives at the boundary between the second and third phases, and the tension between them defines it. Analysis wants time and undisturbed evidence. Containment wants immediate action that inevitably disturbs things.
Getting the sequence right is the whole skill. Contain too early and you lose the visibility needed to understand scope, while alerting the adversary that they have been seen. Contain too late and you are negotiating a ransom.
Minutes 0 to 15: verify before you escalate
Start by establishing that something has actually happened. A meaningful proportion of suspected incidents are misconfigurations, penetration tests nobody told the SOC about, or an administrator doing something unusual but authorised.
Answer three questions before anything else:
- What is the actual observation? Not the interpretation. “EDR alerted on credential access on FIN-WS-04 at 09:12” is an observation. “We have been breached” is a conclusion you have not yet earned.
- Is there a benign explanation? Check change tickets, scheduled tasks and whether any authorised testing is in flight.
- What is the asset? A developer laptop and a domain controller warrant very different urgency.
Open a case record immediately and timestamp everything from this point. Memory is unreliable and reconstruction after the fact is painful. Record what you observed, when, from which source, and every action taken with its time. This becomes your timeline, and it is the single most valuable artefact of the response.
Communicate out of band
If there is any possibility that email, chat or identity infrastructure is compromised, move coordination somewhere the adversary cannot see. Intruders read incident channels. They have been observed sitting in the bridge call, and they escalate deliberately — deploying ransomware early — when they realise they have been detected.
This is why an out-of-band communication plan belongs in preparation rather than being invented mid-incident. Phone numbers on paper, a separate messaging platform on unmanaged devices, a documented conference bridge.
Keep the circle small at this stage. Not secrecy for its own sake, but the wider the notification, the higher the chance someone takes well-intentioned unilateral action that destroys evidence.
Minutes 15 to 30: preserve before you contain
Here is the rule that most first-hour damage comes from ignoring: volatile evidence must be captured before containment changes the machine’s state.
Evidence has an order of volatility. Memory contents vanish on power-off. Network connections and running processes vanish when the process exits or the host is isolated. Temporary files may be cleaned on reboot. Disk contents and centralised logs persist longest.
So, in order:
- Capture memory if the tooling and authority exist. RAM holds injected code, decrypted payloads, credentials and connections that appear nowhere on disk.
- Capture volatile state — running processes with full command lines, active network connections, logged-on users, scheduled tasks, services, persistence locations.
- Confirm central telemetry is retained. EDR, proxy, DNS, VPN and authentication logs. If retention is short, export the relevant window now before it rolls off.
- Then consider disk imaging and containment.
Three actions to prevent explicitly, ideally by telling the asset owner before they think of them: do not reboot, do not run antivirus cleanup, and do not delete anything. Each destroys evidence irreversibly, and cleanup in particular removes the artefacts needed to determine how the intrusion started — which means you cannot tell whether you actually evicted the intruder.
Minutes 30 to 45: scope before you eradicate
The instinct to clean the affected machine immediately is strong and usually wrong. Nearly every intrusion involves more than one host by the time it is noticed, and remediating one while the adversary retains access elsewhere simply tells them to change tactics.
Scope outward from what you know using the artefacts you have:
- Identity. Which accounts were used on the affected host? Where else have those accounts authenticated recently? Authentication logs are usually the fastest route to understanding lateral movement.
- Network. What did the host connect to internally and externally? Has any other host contacted the same external infrastructure?
- Behaviour. Search the estate for the technique rather than the indicator — the same parent-child process pattern, the same persistence mechanism — because the adversary may have varied the tooling between hosts.
- Time. When is the earliest evidence? Initial access is nearly always older than the alert. Dwell time changes the scope of everything.
External indicators found during scoping should be analysed without contacting the infrastructure. Resolving an attacker domain from a corporate address, or visiting a phishing URL, tells the adversary you are investigating.
Analyse a suspicious URL for phishing structure without ever contacting the host, or trace a message’s real path through its headers.
Minutes 45 to 60: contain deliberately
Containment is a decision with trade-offs, not an automatic reflex. The central question is whether to isolate now or observe longer.
Isolate immediately when destructive activity is underway or imminent — ransomware staging, mass file access, data being archived for exfiltration — or when a critical asset such as a domain controller or backup system is involved. In those cases the cost of waiting exceeds the intelligence gained.
Consider observing when the activity appears to be reconnaissance, the affected asset is low-value and well-monitored, and you have both the telemetry and the authority to watch safely. The benefit is a fuller picture of scope before the adversary knows you are there.
Prefer network isolation that keeps the machine running and reachable by your EDR over pulling the power. Powering off destroys memory, which is often where the most valuable evidence lives.
Whichever path you choose, containment should be simultaneous across everything you know about. Isolating hosts one at a time over an afternoon gives the adversary a running commentary on your progress, and their standard response is to accelerate.
Identity containment matters as much as network containment. If credentials were plausibly stolen, disabling a session is insufficient — tokens and Kerberos tickets survive a password reset until they expire. Revoke sessions and refresh tokens explicitly, and treat any account with cached admin credentials on the affected host as compromised.
What the first hour should produce
By the sixty-minute mark you should have a timestamped case record; a preliminary answer to what happened, which assets and accounts are involved, and how far back the evidence goes; volatile evidence preserved; an out-of-band communication channel; a documented containment decision with its rationale; and a clear owner for the next phase.
What you will not have is the full story. That is fine and expected. The purpose of the first hour is not to finish the investigation — it is to make sure the investigation remains possible.
The preparation that makes it work
Everything above depends on decisions made long before. Whether memory acquisition is possible depends on tooling and authority. Whether scoping takes ten minutes or two days depends on log retention. Whether communication stays out of band depends on a plan written when nobody was panicking. Whether isolation is one click or a change-management request depends on delegated authority agreed in advance.
The most valuable preparation exercise is not writing a policy document. It is walking through a plausible scenario and asking, at each step, who has the authority to do this and how long would it take. The gaps that surface in that conversation are the ones that will otherwise surface at three in the morning.
When it is ransomware
Ransomware compresses the first hour dramatically, because encryption is usually the last stage of an intrusion that has been under way for days or weeks. If files are actively encrypting, containment stops being a trade-off and becomes the only priority.
The sequence changes accordingly. Isolate aggressively and in parallel, prioritising the systems that determine whether recovery is even possible: backup infrastructure first, then domain controllers, then file servers and virtualisation hosts. Adversaries deliberately target backups before deploying the payload, so verifying that backups exist, are intact and are genuinely offline or immutable is an urgent first-hour task rather than a recovery-phase one.
Resist the urge to begin restoring immediately. Restoring into an environment where the adversary retains access, or where the initial access vector remains open, results in a second encryption event days later. Preserve enough evidence to answer how they got in before rebuilding, even under pressure.
Note also that encryption is frequently the second extortion stage. Data exfiltration typically precedes it, which changes the legal and notification picture regardless of how well recovery goes. Look for large outbound transfers and archive creation in the days before the payload fired.
When the incident is in the cloud
An identity-based intrusion has no host to isolate, and the reflexes built for endpoints translate badly. The equivalent of containment is revoking access, and the detail that catches teams out is that a password reset alone is insufficient: existing sessions, refresh tokens and issued access tokens remain valid until they expire. Revoke sessions explicitly, and force re-authentication.
Beyond the account itself, check what the adversary established while they held access. Newly registered authentication methods provide durable re-entry that survives a password change. OAuth application consent grants can retain mailbox or file access independently of the user’s credentials entirely. Mailbox forwarding rules quietly exfiltrate for months. Role assignments and delegated permissions escalate privilege in ways that persist after the original account is secured.
The audit logs to preserve are the identity provider’s sign-in and audit logs, plus the workload-specific ones such as mailbox audit and file activity. Retention in default tiers is often shorter than people assume, so exporting the relevant window early is worth the ten minutes it takes.
Evidence handling that survives scrutiny
Most incidents never reach a courtroom, but some become the basis of an insurance claim, a regulatory submission or an employment matter, and none of those announce themselves in the first hour. Handling evidence properly by default costs little and preserves options.
- Hash what you collect. Recording a cryptographic hash of an acquired image or exported log at the time of collection demonstrates it has not changed since.
- Record chain of custody. Who acquired what, when, from which system, and where it has been stored.
- Work from copies. Analyse a copy and leave the original untouched.
- Timestamp in UTC. Multi-system timelines built from mixed local times produce false sequencing, and sequencing is usually the point.
- Record your own actions. Responder activity appears in the same logs as adversary activity. Undocumented, it wastes hours of analysis or, worse, gets misattributed.
Timeline work means converting epoch timestamps across sources, and identifying the algorithm behind an unfamiliar hash.
Who needs to know, and when
Notification is a first-hour consideration even though the obligations mostly land later, because the clock on several of them starts at detection rather than at confirmation. Regulatory regimes impose defined windows — GDPR’s seventy-two hours for qualifying personal data breaches being the widely known example — and cyber-insurance policies frequently require prompt notification as a condition of cover, sometimes mandating the use of an approved response provider.
What the first hour needs is not a completed notification, but the recognition that a clock may have started, and the involvement of whoever owns that decision. That is usually legal counsel and an executive sponsor, not the SOC. Getting them into the loop early costs nothing; discovering on day four that a regulatory window elapsed on day two is unrecoverable.
Keep factual discipline in all early communication. Statements made in the first hour have a way of persisting into external messaging, and premature attribution or scope claims tend to be wrong.
The handoff
Incidents outlast shifts, and the transition between responders is where context is most often lost. A structured handoff should convey the current working hypothesis and, crucially, the confidence attached to it; a factual timeline; every containment action taken and when; what has been ruled out and on what evidence; outstanding questions with an owner for each; and any decisions pending someone else’s authority.
The distinction between confirmed and suspected matters enormously here. Assumptions that pass through two handoffs tend to arrive as established fact, and investigations built on a misremembered assumption are expensive to unwind.
A first-hour checklist
- Open a case record and start a UTC timeline.
- Verify the observation; rule out authorised activity.
- Identify the asset, its owner and its criticality.
- Move coordination out of band if identity or mail may be compromised.
- Capture volatile evidence before altering system state.
- Confirm relevant central logs exist and export the window if retention is short.
- Scope by account, network and behaviour before eradicating anything.
- Make an explicit containment decision and record its rationale.
- Contain simultaneously across everything known.
- Revoke sessions and tokens, not only passwords.
- Notify legal and executive stakeholders if a reporting clock may have started.
- Assign a clear owner for the next phase.
None of it is complicated. Under pressure, at an unreasonable hour, with an executive asking for updates every ten minutes, having the list written down in advance is what makes it happen.