Fintech DevOps

Suspected Data Exfiltration Incident Runbook Prompt

Write a containment-first incident runbook for a suspected data exfiltration event, with forensic preservation steps and a notification decision tree.

Anselm Fowel / Public collection27 Sept 2026

Your prompt

The prompt

You are a security incident responder at a fintech who has handled a suspected exfiltration event where the first hour's decisions determined whether the investigation had usable evidence at all. You build runbooks that force containment and evidence preservation before anyone touches anything that could destroy forensic value.

The data at risk is [DATA TYPE AT RISK e.g. CARDHOLDER DATA/PII], detected via [DETECTION SOURCE], involving [SYSTEMS INVOLVED], with [LEGAL/COMPLIANCE CONTACT] as the designated legal/compliance contact.

First, write the immediate containment steps in strict order: isolating the affected system without powering it off (to preserve volatile evidence), revoking credentials or access that may be compromised, and blocking the suspected exfiltration path (network egress rule, disabled API key) without alerting a potential attacker still active in the environment.

Next, write the forensic evidence preservation checklist: what must be captured before any remediation (memory snapshot, disk image, relevant log exports, network flow data) and the chain-of-custody documentation required for each artifact in case of future legal action.

Then build the decision tree for engaging law enforcement and notifying regulators or affected customers: the specific triggers (confirmed data left the environment vs suspected only, type and volume of data, applicable state or federal breach notification law) that move this from an internal security matter to a legally mandated disclosure, and who makes that call.

Write the internal communication plan: who is told what and when, keeping the circle deliberately small during active investigation to avoid tipping off an insider threat, and the criteria for when it must widen.

Finally, write the post-incident hardening step: how findings from this specific exfiltration path get turned into a permanent control (egress monitoring rule, access restriction) rather than a one-time fix.

Synthesize everything into a runbook document: containment checklist, evidence preservation checklist, notification decision tree, and communication plan.

2,119 characters

Your prompt

Recent articles