Skip to content
Cyber Unboxed
SOC & Blue Team

Incident Response: What Happens After the Alarm Goes Off

An alert is only the beginning. Incident response is the calm, repeatable process for what comes next.

2 min readIntermediate Sep 4, 2026

Explain Like I'm Not a Hacker

It is a fire drill for computers: everyone knows their job, the fire is contained first, and afterwards you work out how it started.

The 30-second explanation

When something goes wrong, a good team does not panic. It follows a plan: confirm what happened, stop it spreading, clean up, get back to normal, then learn from it.

How it works

  1. 1

    1. Prepare

    Plans, contacts, tools and practice.

  2. 2

    2. Detect & analyse

    Confirm it is real and find the scope.

  3. 3

    3. Contain & remove

    Stop it spreading, then remove the cause.

  4. 4

    4. Recover & learn

    Restore safely and improve.

Before an incident you prepare: contacts, tools, backups and practice. When an alert arrives, analysts confirm whether it is real and how far it reaches. Containment limits damage, for example by isolating machines or disabling accounts. Eradication removes the attacker's access and the cause. Recovery restores systems safely. Afterwards, the team writes down what happened and changes things so it is harder next time.

Real-world example

An alert shows one laptop contacting an unknown server. The team isolates it, finds the same connection on a second machine, disables the affected account, removes the malicious software, restores normal service, and later adds a detection so the same pattern is caught sooner.

How to spot it

  • No one knows who is in charge

    Confusion about roles slows every step.

  • Fixing before understanding

    Rebuilding a machine before finding out how it was breached.

  • Evidence lost

    Logs overwritten or devices wiped too early.

  • No follow-up

    The same incident repeats because nothing changed.

What to do

  1. 1Write down who does what, and keep contact details somewhere reachable during an outage.
  2. 2Contain first, but preserve logs and evidence before rebuilding anything.
  3. 3Hold a short review after every incident and record the changes you will make.

Stay curious. Stay safer.

This is one piece of a bigger picture. Explore more real-world examples, concepts and tips to build your cybersecurity awareness.

Explore More

Keep reading