Preserve before you contain

About 14 min read

On this page

E Pillar 04 of 05

Containment stops the harm and destroys evidence in the same motion. When triage runs the pre-authorized actions before IR arrives, triage owns the minutes before them too: capture what the action is about to destroy, check whether the action tells the adversary what you know, record what you took, then act.

Why this sits in triage

IR owns containment Containment The incident-response phase between detection and eradication: isolate the affected hosts, revoke the compromised credentials, block the C2 destinations, freeze the situation so it stops getting worse while the investigation continues. In triage, preservation comes first: capture the volatile evidence and the artifacts a containment action would destroy, then take only the reversible actions the protocol pre-authorizes. Non-reversible actions, such as a credential reset or an OAuth grant revocation, need IR or owner approval unless the protocol lists them as pre-authorized for that scenario. strategy, with one deliberate exception: the short, written list of pre-authorized immediate actions that triage may run without waiting, such as isolating a host, disabling an account, revoking sessions, or disabling a consented app’s sign-in. Those actions run in the minutes after the escalation tripwire fires, often before IR has acknowledged the page. Whatever evidence they destroy is gone before the first responder joins the bridge.

So the rule that governs the list starts here: preserve, then contain. A preservation step comes before every pre-authorized action. It captures the volatile evidence and the specific artifacts that action destroys, and it is measured in minutes, not in an investigation. In the worked cases it took two minutes for an identity case and nine minutes for two endpoints with memory capture.

Three more rules travel with it:

• Reversible only. Pre-authorized actions can be undone. Actions that cannot (a credential reset, removing an OAuth consent grant, deleting a mailbox rule, terminating a cloud instance) need IR or owner approval, unless the protocol lists them explicitly as pre-authorized for that scenario.
• Preserve what this action destroys. Not everything, and not a full forensic image. The question is narrow: what will exist before this action that will not exist after it?
• Destruction in progress shortens the step, it does not skip it. If encryption is running or data is leaving right now, take the action that stops it first when that action keeps the evidence (EDR isolation keeps memory, as below), capture what survives through the channel that is still open, and record why the order changed.

The doctrine is old. RFC 3227 (February 2002) says do not shut down until evidence collection is complete, and minimize changes to the data while collecting it. The joint advisory AA20-245A from CISA and the Australian, Canadian, New Zealand and UK cyber centres (September 2020) lists “mitigating the affected systems before responders can protect and recover data” first among its common mistakes in incident handling, because it loses volatile data and alerts the adversary.

---

The order of volatility in 2026 terms

The order of volatility Order of Volatility The principle (RFC 3227) of collecting evidence from the most to the least short-lived: CPU state and memory, network connections and running processes, temporary files, disk, then remote logs and backups. A reboot or an EDR isolation can destroy the top of the list, which is why preservation comes before containment. See Preserve before you contain. is RFC 3227’s principle: collect from the most short-lived evidence to the least. Its original list runs from registers and cache, through routing tables, process tables and memory, temporary file systems and disk, to remote logs, physical configuration and archival media. That list was written for a single server. A 2026 case spans an endpoint, an identity provider, a SaaS tenant and a cloud account, so the ladder below orders evidence by how soon the response itself, or the clock, destroys it.

1. Live state: the attacker’s active session, open network connections, the live C2 channel. Ended by isolation, session revocation, or a blocked address, and it can never be re-collected.
2. Memory and running processes: injected code, decrypted payloads, credentials and tokens in memory, command history. Ended by a reboot, shutdown, reimage, instance termination, or killing the process.
3. Ephemeral workloads and temporary storage: containers, instance-store volumes, temp directories, serverless execution environments. Ended by teardown, eviction, or scaling in.
4. Object state in identity and SaaS: inbox rules, OAuth grants, MFA methods, registered devices, delegates, service-principal credentials. Each lasts until someone removes it, and removal is exactly what remediation does.
5. Short-retention logs: identity-provider consoles (7 or 30 days on Microsoft Entra ID, depending on license), EDR console telemetry (days to weeks), local and appliance logs in rolling buffers. Ended by the calendar. The defaults are on the retention table.
6. Disk: files, persistence, artifacts. Ended by reimaging, or slowly overwritten by normal use.
7. Long-retention copies: SIEM copies, archived audit logs, backups. Usually safe for months, unless a cleanup job or a lifecycle rule reaches them first, which is why Scope’s preserve move looks for those jobs.

Endpoint

• EDR isolation keeps memory; reboot and reimage do not. Network isolation through EDR Endpoint Detection and Response (EDR) Agents that record process, file, registry, network and module-load activity on endpoints, detect suspicious behavior, and let responders isolate hosts or kill processes remotely. EDR telemetry is the backbone of endpoint triage. Know its blind spots: unmanaged and BYOD devices, appliances that cannot run an agent, and identity or SaaS activity that never touches a host. A missing or silent agent is a finding. leaves the host running. In Microsoft Defender for Endpoint, an isolated device stays connected to the Defender service, so live response Live Response An EDR remote shell on an endpoint, Microsoft Defender for Endpoint's name for the feature, used to collect forensic data such as memory, files and process lists. It still works on a network-isolated host, which stays connected to the EDR service. See Preserve before you contain. and investigation-package collection still work after isolation. What isolation destroys is the live network state: open connections and the beacon. A reboot destroys memory, and a reimage destroys the disk as well. Never contain an endpoint by powering it off, and tell the user not to restart it.
• The order at the keyboard: record the live state the EDR shows (process tree, network connections, logged-on users), start any memory capture Memory Capture Imaging a running system's RAM, also called memory acquisition, before a reboot, reimage or process termination destroys it. Memory holds what disk does not: injected code, decrypted payloads, live connections, keys. On a production server it can destabilize the system, so it needs the owner's approval. See Order of Volatility and Preserve before you contain. the triggers below call for, isolate, then run the triage collection ( KAPE KAPE Kroll Artifact Parser and Extractor: a free-to-download triage tool (Kroll sells an enterprise license for commercial use on client engagements) that collects and parses forensic artifacts from a live system in minutes. A staple for fast evidence capture before (or instead of) full disk imaging. , Velociraptor Velociraptor Open-source endpoint-visibility and DFIR platform (stewarded by Rapid7); hunts for and collects artifacts across entire fleets using its VQL query language. Also abused by intruders (2025 ransomware cases deployed it for remote access), so an unsanctioned Velociraptor install or server is itself suspicious. , or the EDR’s own package) through the channel that isolation left open.
• Trigger a memory capture when any of these hold: a live C2 channel or an interactive operator; a payload that may exist only in memory (injected code, an encoded PowerShell stage with nothing on disk); suspected credential theft from memory; a host that someone else is about to reboot, patch or reimage. When none hold, a triage collection is usually enough. On production servers, memory capture can destabilize the system, so it needs the owner’s approval.
• Automation may have acted first. EDR auto-remediation can kill processes, quarantine files or isolate the host before a human sees the alert. Record what the automation did and when, and preserve what is left.

Identity and SaaS

• Export the records before the console ages them out. The sign-in records (interactive and non-interactive, with session and correlation IDs), the tenant audit log for the window, and the risk detections. Export from the source, not only the SIEM copy: ingestion often drops fields, and an export with its query and hash is evidence where a dashboard view is not.
• Snapshot objects before removal. The audit log records that an inbox rule, a consent grant or an MFA method was created. The object itself shows what it looks like now, including later changes. Export the inbox rules and forwarding settings, the OAuth grants and the app’s service principal (publisher, scopes, consent time, consenting session), the MFA methods and registered devices, and any mailbox delegates. The consent grant OAuth Consent Grant (Illicit Consent) A user's or admin's approval that lets a third-party application act on their data with the permissions (scopes) it requested, such as Mail.Read and offline_access. Attackers abuse it by luring users into consenting to a malicious app (consent phishing), which gives API access that survives a password reset and MFA. Triage: check the publisher's verification, the scopes, and the consent event in the audit log. Revoking the grant is a non-reversible step that needs IR or owner approval unless the protocol pre-authorizes it. ATT&CK T1528. and the MFA snapshot matter most, because their removal is a non-reversible step taken later with IR’s approval. The identity-persistence sweep lists every object to snapshot and check.
• Revocation ends the live view, not the records. Once sessions are revoked, the attacker’s next attempt is your verification evidence, so record it. Already-issued access tokens can stay valid until they expire, which on Microsoft Entra ID defaults to a random 60 to 90 minutes, except where continuous access evaluation is enforced and revokes them in near real time. Order matters too: revoke sessions before the credential reset, so a stolen session does not outlive the new password.

Cloud

• Snapshot before terminate. Terminating an EC2 instance erases its memory and instance-store data, and an EBS root volume attached at launch is deleted with it by default. The AWS Security Incident Response Guide orders the steps: capture the instance metadata; enable termination protection, set shutdown behavior to stop, and turn off delete-on-termination for the attached volumes; tag the instance; snapshot the EBS volumes; acquire memory; then isolate. Termination is not on the triage list.
• Isolation by security group is not instant. Changing a security group does not interrupt connections it is already tracking; they continue until they time out. A stateless network ACL breaks existing connections. Verify, do not assume.
• Ephemeral workloads take their evidence with them. When a Kubernetes pod is evicted from a node, its containers and their logs go too. Isolate the pod with a network policy and cordon the node rather than deleting the pod, and collect its logs first.
• Logging that is off by default cannot be preserved. AWS CloudTrail AWS CloudTrail Records API activity in an AWS account: the audit trail for security and forensic work. Management events are on by default (90 days in Event history); data events such as S3 object reads and Lambda invokes must be enabled on a trail or event data store. ’s 90-day event history holds management events only; data events need a trail or an event data store. GCP Data Access audit logs are off for most services until enabled. Azure resource logs need a diagnostic setting. Turning logging on now, through the owner, captures what comes next; record the gap before it in the packet’s open questions.

---

The tip-off check

Before any visible action, run the tip-off check Tip-Off CheckASSURED term In ASSURED, the question asked before any visible containment action: does this action tell the adversary what the SOC knows, and does that matter more than the harm in progress? When harm is not in progress, IR times visible actions. See The tip-off check. . Ask one question: will this action tell the adversary what we know, and does that matter more than the next thirty minutes of dwell? Containment is visible. A beacon that drops, a session that ends, or a rule that disappears tells an operator they have been seen, and an operator who knows can destroy evidence, switch to footholds you have not found, or rush to impact. That is a second reason to preserve first: the adversary may delete what you did not export.

Three habits avoid accidental tip-offs whatever the call. Do not touch adversary infrastructure from the corporate network (no pinging, resolving or browsing to it; use passive sources). Do not block infrastructure or reset credentials preemptively, before IR has the picture: CISA’s advisory names both as common mistakes, because the adversary switches infrastructure or uses other credentials and you lose visibility. And keep response communications out of band when the compromised system is the one you would use to coordinate, such as the mail tenant in Case C.

The analyst raises the tip-off question; when harm is not in progress, IR answers it. The protocol can suspend the pre-authorized list for a case where IR is running covert observation.

---

The minimum chain-of-custody record

Every preservation step produces artifacts, and an artifact without a custody Chain of Custody The documented, unbroken record of who collected a piece of evidence, when, how, and every hand it passed through since, with hashes that show it was not altered. Triage starts the chain the moment it exports a log, captures memory or saves an email: record the source, the time, the tool and the hash in the case. Evidence without a chain is harder to use in legal, HR or regulatory proceedings. See Preserve before you contain. record is harder to use in front of a regulator, a court, or an HR process. The chain-of-custody procedure on the standards page gives the full version. At triage speed, record five things the moment each artifact is acquired:

One record, as the Case C analyst wrote it for the inbox rule:

Artifact:   inbox rule "." on rvega's mailbox, full definition (JSON export)
Source:     mail tenant admin export, Get-InboxRule for rvega
Acquired:   2026-03-12 09:23 UTC by the Tier 1 analyst on shift
Tool:       tenant admin PowerShell module, version recorded in the case
SHA-256:    recorded in the case at acquisition
Stored:     case evidence store, CASE-20260312-022/preservation/
Transfers:  none yet; IR receives a link with the 09:28 packet

Flag a legal hold early. When litigation or a regulatory response is plausible, tell counsel which systems hold relevant data and which jobs will destroy it (log rotation, ephemeral teardown, cleanup). Counsel issues the hold and sets its scope; Scope’s regulatory page covers the analyst’s part.

---

Decision table

Each row is one action. Read it as: before this action, run this preservation step, because this evidence is at risk. “Pre-authorized” means on the reversible list in the typical playbook; your protocol’s list is the one that counts.

Every action and every preservation step goes into the handoff packet: what was preserved, in section 6 before the containment it protected, and each artifact’s custody state in section 7.

---

Case C applied: two minutes of export, then containment

In Case C, the analyst confirms at 09:22, at the end of Alert, that an attacker is operating rvega’s mailbox through a replayed hijacked session Session Hijack Taking over an active session by stealing or guessing session tokens or cookies, bypassing authentication and MFA. , with a hiding inbox rule and an unverified app consented from that session. The escalation tripwire fires and the IR lead is paged by pager and phone bridge, not tenant email or chat. The tip-off check is quick: payment searches and an app reading mail mean harm is in progress, and every foothold the tenant audit shows (the session, the rule, the app) is about to be contained at once. Act now.

Two failure modes sit on either side of this timeline. Contain without preserving, and the grant’s scopes, the rule’s definition, and the state of rvega’s MFA methods at 09:24 survive only as audit-log inferences, not as hashed exports. Wait to contain until Uncover has finished at 10:16, and the session stays live for most of another hour after the payment searches have already run. The two-minute export avoids both: most of what it captured would have survived containment in the audit log, but the export makes it certain and verifiable, and the object snapshots capture state the log only implies.

The same rule on endpoints: Case A

In Case A, the finance-team intrusion, the escalation arrives hours late, and the preservation step still runs before containment: memory capture and EDR triage collection on both laptops, exports of the identity provider’s sign-in and session records for both users, and the proxy logs held, from 14:10 to 14:19. Both hosts are isolated at 14:20, and sign-in is blocked with all sessions revoked at 14:21. Nine minutes bought memory images of both hosts, open connections included, before isolation cut those connections. The password resets, the message purge and the infrastructure blocks wait for IR, because none of them can be undone.

Sources and further reading

• D. Brezinski and T. Killalea, RFC 3227: Guidelines for Evidence Collection and Archiving (BCP 55, February 2002): section 2.1, order of volatility; section 2.2, things to avoid.
• CISA and partners, AA20-245A: Technical Approaches to Uncovering and Remediating Malicious Activity (1 September 2020, revised 24 September 2020): key takeaways and common mistakes in incident handling.
• AWS, AWS Security Incident Response Guide: collect relevant artifacts, and security group connection tracking (both checked October 2026).
• Microsoft Learn, Take response actions on a device in Defender for Endpoint (updated July 2026), Configurable token lifetimes (updated April 2026), and Microsoft Entra data retention (updated January 2026).
• Kubernetes, Logging architecture (checked October 2026).
• NIST SP 800-86, Guide to Integrating Forensic Techniques into Incident Response (2006), and ISO/IEC 27037 for collection procedure beyond triage.

Next up

The handoff packet

Read the packet