Sample incident response with team 2026

--- Incident type: Phishing email attacks ---

RESPOND TEAMS: FOUR MEMBERS AS INCIDENT RESPONSMENT TEAM MEMBERS
DATE: 06.02.2026, Friday, 11:00
Updated date: 06.02.2026, Friday, 11:21 / 11:23 (V2) / 11:28 (V3) / 11:33 (V4) / 11:36 (V5)
TEAM MEMBERS: Martin (DETECTION), N2 (CONTAINMENT), N3 (ERADICATION) and N4 (RECOVERY)
Everyone else (post-incident review)
Licensed under CC-BY-SA 4.0.

Please note this is training purposes only, not real.

DCERP (shorten)

BUILD A BASIC INCIDENT RESPONSE PLAYBOOK

Scenario: Your organization has detected a phishing attack targeting employee email accounts.

1. DETECTION: Email spams, automated alerts, user suspicious activity, fake password resets, suspicious malware programs attached
2. CONTAINMENT: To isolate the accounts, prevent the further spread (disable isolated accounts) and password reset
(only affected for accounts)
3. ERADICATION: Remove phishing emails and block malicious senders/IP addresses.
Revoke all compromised tokens, enable phishing resistant multi factor authentication (2FA).
4. RECOVERY: Run a full device with system scan by antivirus software (Malwarebytes, McAfee, Norton).
If the sign still there with malware on the device, then completely wipe it and reinstall OS.
5. Post-Incident Review: N4: Audit organization rules.
N4: scan backups for malware before restoring the system.
MARTIN: Improve the training expressions and document the incident to prevent further incidents next time and create a runbook.
N3: Update the playbook with any new findings.
N2: Email filter rules should be updated as well

THOUGHTS FROM OTHER TEAM MEMBERS:
D: Check emails for detection.
R: Bit document incident, evidence further analysis
PIR: Prevent any further incidents (same or different?)