Skip to content

Add temporary containment control ledger gates #2244

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
malb200710-dev wants to merge 1 commit into
base: main
Choose a base branch
from
+27 −1
Open

Add temporary containment control ledger gates #2244

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
28 changes: 27 additions & 1 deletion skills/incident-response/containment/SKILL.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,7 @@ phase: [respond]
frameworks: [NIST-SP-800-61r2, MITRE-ATT&CK]
difficulty: intermediate
time_estimate: "15-30min"
version: "1.0.1"
version: "1.0.2"
author: unitoneai
license: MIT
allowed-tools: Read, Grep, Glob
Expand Down Expand Up @@ -235,6 +235,27 @@ Define conditions under which containment actions should be rolled back or modif
| Containment action was applied to wrong scope (false positive) | Remove containment controls from unaffected systems | Incident Commander |
| Eradication complete and validated | Phase out containment controls in stages with monitoring | Incident Commander + Security Team |

### Step 6b: Temporary Containment Control Ledger

Emergency containment often creates short-lived firewall blocks, DNS overrides, EDR isolation policies, IdP session revocations, WAF rules, CDN cache purges, SaaS sharing restrictions, or allowlist exceptions. Track these controls in a ledger so emergency changes do not become unowned permanent drift.

For each temporary containment control, record:

| Field | Required evidence |
|---|---|
| Control ID | Ticket, change record, SOAR action ID, or console audit event |
| Control type | Firewall, DNS, EDR, IdP, SaaS, WAF/CDN, cloud policy, or other |
| Scope | Exact accounts, hosts, groups, tenants, zones, paths, or indicators affected |
| Owner | Named responder or team accountable for validation and removal |
| Approval | Incident Commander, business owner, legal, or emergency-change authority |
| Start time | UTC timestamp when the control became effective |
| Expiry / review time | UTC timestamp or event that requires renewal, downgrade, or removal |
| Effectiveness evidence | Log, query, health check, or failed attacker action proving the control works |
| Business-impact evidence | Service health, user impact, exception requests, or accepted outage record |
| Removal plan | Exact rollback command/change path and expected validation after removal |

**Finding classification:** Missing owner or expiry for a temporary containment control is **Medium**. A temporary allowlist, bypass, or broad deny rule that remains active after the incident without renewed approval is **High**. A containment exception that restores attacker access or disables required monitoring is **Critical**.

---

## 4. Findings Classification
Expand Down Expand Up @@ -284,6 +305,11 @@ threat severity and business criticality, and expected impact on operations.]
|---|---|---|---|---|
| [Action] | [Scope] | [Duration] | [Planned/In Progress/Complete] | [Name] |

### Temporary Containment Control Ledger
| Control ID | Type | Scope | Owner | Approval | Start Time | Expiry / Review Time | Effectiveness Evidence | Removal Plan |
|---|---|---|---|---|---|---|---|---|
| [Ticket/Change/SOAR ID] | [Firewall/DNS/EDR/IdP/SaaS/WAF/CDN/Cloud] | [Exact scope] | [Name/team] | [Approver] | [UTC] | [UTC/event] | [Evidence] | [Rollback path] |

### Business Impact Assessment
| Service/System | Impact of Containment | Mitigation | Acceptable |
|---|---|---|---|
Expand Down