Question

During an active incident, a SecOps analyst confirms that a compromised employee laptop is actively exfiltrating data over an established C2 channel, and the same user's OAuth refresh tokens have been observed authenticating from a foreign ASN within the last 10 minutes. The SOAR playbook offers automated containment actions for both the endpoint (network isolation via EDR) and the identity (revoke sessions and reset credentials). The team wants to stop ongoing damage while preserving the ability to complete root cause analysis. Which containment sequencing decision best meets these goals?

Accepted Answer

Revoke the user's OAuth sessions/tokens and reset credentials first, then isolate the endpoint from the network, because both attack paths are live and identity abuse can persist independently of the laptop.

Answer

Isolate the endpoint from the network first and take no identity action, since network isolation cuts the C2 channel and thereby stops all attacker access.

Answer

Wait to execute any containment until a full forensic disk image of the laptop is captured, to guarantee evidence integrity before disrupting the attacker.

Answer

Power off the laptop immediately and disable the user account, prioritizing the fastest possible shutdown of all activity regardless of investigative impact.