ZONE: EMERGENCY
Rapid triage
If you suspect an active incident, use this channel for immediate assessment and next steps.
Immediate actions:
- Isolate affected hosts (network segmentation).
- Preserve logs / images (avoid wiping evidence).
- Identify scope (endpoints, shares, backups).
Request briefing
Send a short description — we’ll respond with a triage checklist and next steps.