A plan you can remember
When something is wrong, it is easy to panic and click around. Don't. Every incident follows the same four steps, and you already practised each one in earlier modules:
- Find — read the logs and work out what happened and who the attacker is (their address).
- Contain — stop the attacker doing more damage right now, for example by locking or deleting their account.
- Remove — take away everything they left behind: backdoor accounts, auto-start services, sudo shortcuts.
- Report — write down what happened and what you did, so the team learns from it.
That is the whole job, in order. The capstone lab below walks you through all four on one machine.
Tip: “Contain” before “Remove” is deliberate: cut off the attacker's access first, then take your time cleaning up.