An incident response playbook with AegiFlow
A practical sequence for the first thirty minutes of a web incident: read the case, decide on containment, keep the service useful, recover with proof.
You can run a calm, evidence-driven response instead of improvising under pressure.
Minute 0-5: read the case, not the noise
Open the case, not a log file. The timeline already correlates the signals: what was observed, on which routes, with what confidence. Resist acting before reading the scope.
Minute 5-15: contain with bounds
If containment is warranted, apply the proposed bounded control: specific routes, specific fingerprints, a short TTL. Sensitive decisions require fresh step-up verification - that is deliberate friction. Watch the health checks; a control that hurts legitimate traffic gets rolled back, not defended.
Minute 15-30: protect the visitor experience
If the origin must be isolated, activate the signed continuity bundle so visitors keep seeing approved content. Communicate from evidence: you know exactly what was observed and what was done.
Afterwards: recover with receipts
Run recovery through the staged process - business checks gate each traffic step. Export the case: every decision, actor and outcome is already recorded for the postmortem.
Verification
- Each decision in the case timeline has an author and a result
- Containment actions carry a TTL and rollback state