The Incident Response Handbook

Every IR framework follows the same skeleton: Preparation, Detection, Analysis, Containment, Eradication, Recovery, Post-Incident. The ManySignal case lifecycle maps directly: a finding triggers a case, triage produces analysis, approved response actions execute containment and eradication, and the closed case timeline becomes the post-incident artefact.

The advantage of an agentic IR model is speed. Containment that previously required a human to log in to four systems, verify permissions, and click through confirmation dialogs now executes in seconds via the respond agent — with the same audit trail, the same approval gate, and the same rollback capability.

Effective IR begins with a high-confidence detection that carries enough context to start analysis immediately. ManySignal findings include: the triggering event, the entity graph snapshot at detection time, the behavioural score, the ATT&CK technique, and the pre-computed triage question answers. The analyst opening the case does not start from raw logs.

Initial analysis should answer four questions in under 10 minutes: What happened? Which entities are involved? Is activity ongoing? What is the initial blast radius? The entity graph answers questions two and four; the case timeline answers one and three.

Scope creep is the most common analysis failure. Set a scope boundary early — the specific identity, device, or application under investigation — and expand it deliberately rather than following every tangential indicator.

Containment options in ManySignal: isolate host (EDR quarantine), revoke session (Okta/Entra ID), disable account (IdP), block IP (firewall/WAF), rotate credentials (secrets manager), restrict role (IAM policy update). Each action has a configured autonomy rung and blast-radius limit.

Every containment action is reversible. Rollback is a first-class operation on the case timeline — one click reverses the action and logs the reversal with actor and timestamp. This matters when containment turns out to be a false positive: the analyst can undo in the same interface without touching the underlying system directly.

For high-severity incidents (ransomware, credential compromise at scale), use the tenant-level kill switch to halt all agentic actions mid-flight while humans assess scope. The kill switch is not a panic button — it is a deliberate tool that should be practiced in tabletops so the team knows exactly what it does and doesn't do.

The ManySignal case timeline is an append-only, hash-chained evidence log. Every action, every verdict, every human comment, every agent output lands on the timeline with a timestamp and actor identity. The timeline is the chain of custody — it does not need to be reconstructed after the fact.

For forensic preservation beyond the platform, export the case timeline as a signed JSON package. The package includes the raw event log, the entity graph snapshot, all action records, and the cryptographic hashes that prove the record was not modified post-incident.

Post-incident review has one purpose: make the next incident faster and cheaper to handle. Use the ManySignal case timeline to run a structured timeline replay — walk every action and decision in order and identify the earliest point where a different detection, question set, or response action would have reduced impact.

Output from every PIR should be at least one detection improvement (new rule, updated question set, or threshold change), one playbook update, and one tabletop scenario derived from the actual TTP used in the incident.

The report agent can generate a draft PIR from the case timeline automatically. The draft includes timeline, entities involved, ATT&CK mapping, actions taken, and metrics (time to detect, contain, eradicate). Human review adds the improvement recommendations.