Overview
Containment is the phase where the SOC limits the damage of a confirmed incident and stops it from spreading — buying time to eradicate the threat without letting it cause further harm.
Learning objectives
- Define containment and its goal in incident response.
- Distinguish short-term from long-term containment.
- Explain the balance between stopping spread and preserving evidence.
Core concept
Containment aims to limit the scope and impact of an incident and prevent further spread while the team prepares to eradicate the threat. It follows identification (which scoped the incident) and precedes eradication. Containment is often split into short-term (immediate actions to stop active harm — e.g. isolating a compromised host via EDR, disabling a compromised account, blocking malicious infrastructure) and long-term (more durable measures that keep the environment stable until eradication, such as applying temporary access controls or rebuilding a clean system to bring back online). A central tension, echoing the safe-response concepts from earlier modules, is balancing stopping the attacker against preserving evidence for investigation — acting decisively without destroying the forensic picture needed to understand the full incident.
How it works
Using the scope from identification, the SOC takes short-term containment actions to halt active damage: isolating affected hosts from the network (EDR host isolation from module 12), disabling compromised accounts (relating to authentication anomalies, module 10), and blocking malicious IPs/domains/URLs (IOCs, module 7) at the firewall/proxy. These stop spread quickly. Containment must be complete across everything scoped — isolating one host while leaving another compromised host active lets the incident continue. Throughout, the SOC preserves evidence (memory, disk, logs) before actions that might destroy it, so eradication and reporting have the data they need. Long-term containment then keeps things stable — for example, standing up clean replacement systems, tightening access, and monitoring — until the threat can be fully eradicated (next phase). Decision authority for these actions comes from the IR plan established in preparation.
Practical example
Identification scoped an incident to three compromised hosts and one account. For containment, the SOC uses EDR to isolate all three hosts from the network simultaneously (short-term), disables the compromised account, and blocks the attacker's known IOCs at the perimeter. Before wiping anything, it captures evidence (memory and disk images, relevant logs) so the forensic picture is preserved for eradication and the final report. Because containment covered every scoped system — not just the first host — the attacker loses access everywhere at once and cannot pivot to a host that was overlooked. The team then maintains long-term containment (monitoring, tightened access) until eradication removes the threat entirely. This illustrates complete containment that stops spread while preserving evidence.
Cybersecurity relevance
Containment is where scoping turns into decisive action that limits damage — the difference between a contained incident and a spreading breach. It draws directly on earlier modules: EDR host isolation, account disabling, and IOC blocking are the mechanisms; the safe-response principle (contain without destroying evidence) is the discipline. Its completeness depends on identification's scope, and its evidence preservation feeds eradication and incident reporting. Effective containment minimizes impact and cost while keeping the forensic trail intact, making it the phase where preparation and detection pay off in reduced harm.
Common mistakes
- Incomplete containment — isolating some affected systems while others remain compromised, letting the incident continue.
- Destroying evidence during containment (e.g. wiping a host before imaging it), crippling investigation and reporting.
- Acting without authority or a plan, causing confusion or business disruption that a clear IR plan would prevent.
Key takeaways
- Containment limits the impact of a confirmed incident and stops it from spreading, ahead of eradication.
- It spans short-term actions (isolate hosts, disable accounts, block IOCs) and long-term measures that keep the environment stable.
- Containment must cover the full scope and preserve evidence — stopping the attacker without destroying the forensic picture.
Check your understanding
- What is the difference between short-term and long-term containment?
- Why must containment be complete across scope, and how does the SOC balance stopping spread with preserving evidence?