Incident Response: First Hour
Do not destroy evidence or trust a root-compromised host. Isolate the machine, capture volatile facts when safe, rebuild from a clean image, and rotate SSH keys, database passwords, and API tokens.
Do not destroy evidence or trust a root-compromised host. Isolate the machine, capture volatile facts when safe, rebuild from a clean image, and rotate SSH keys, database passwords, and API tokens.