skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

performing-cloud-incident-containment-procedures

Execute cloud incident containment across AWS, Azure, and GCP by isolating resources and revoking credentials.

954|172|Updated Mar 13, 2026
Search Tags:#AWS#Azure#GCP#incident response#cloud security#containment#forensics
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill performing-cloud-incident-containment-procedures
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: performing-cloud-incident-containment-procedures
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/incident-response/performing-cloud-incident-containment-procedures
Command: npx skills add https://github.com/xalgord/xalgorix --skill performing-cloud-incident-containment-procedures

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

When a cloud account, instance, or storage resource is compromised, responders must act quickly to isolate the threat without destroying forensic evidence. This Skill provides concrete, platform-specific containment procedures for AWS, Azure, and GCP so responders can stop lateral movement while preserving evidence for investigation.

Core Features & Use Cases

  • Credential and Identity Containment: Disable IAM access keys, attach deny-all policies, revoke STS sessions and Azure AD refresh tokens, and disable GCP service accounts.
  • Resource Isolation: Quarantine EC2 instances, Azure VMs, and GCP compute instances using security groups, NSGs, and firewall rules after taking forensic snapshots.
  • Evidence Preservation: Create disk snapshots, enable S3 Object Lock in COMPLIANCE mode, and protect CloudTrail and activity logs before containment actions.
  • Use Case: During an active breach where an EC2 instance shows malicious activity, snapshot its volume, apply a quarantine security group, revoke the compromised role's sessions, and verify via CloudTrail that the attacker's API calls now return AccessDenied.

Quick Start

Use the cloud incident containment skill to isolate a compromised AWS EC2 instance, revoke its IAM role sessions, and preserve a forensic snapshot.

Frequently Asked Questions about performing-cloud-incident-containment-procedures

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I isolate a compromised EC2 instance in AWS?▼

Create a quarantine security group with no inbound or outbound rules, take a forensic EBS snapshot first, then apply the quarantine group to the instance with modify-instance-attribute. Tag the instance with the IR case number for tracking.

How do I revoke compromised IAM credentials in AWS?▼

Disable or delete the user's access keys and attach a deny-all inline policy. For roles, add a deny policy with an aws:TokenIssueTime condition, since disabling keys alone does not invalidate already-issued STS tokens.

Does disabling an Azure AD user revoke active sessions?▼

No, setting AccountEnabled to false does not kill already-issued refresh tokens. Run Revoke-AzureADUserAllRefreshToken to invalidate existing sessions, and verify through Azure Activity logs that further calls are denied.

Why should I snapshot a disk before containment?▼

Stopping or terminating an instance before snapshotting wipes instance-store volumes and RAM, destroying forensic evidence. Always create disk snapshots and capture memory first, then apply network isolation rather than powering off.

How do I stop a compromised AWS Lambda function?▼

Set the function's reserved concurrency to zero to block all invocations, then list and delete its event source mappings. This halts execution without deleting the function, preserving it for later analysis.

What persistence mechanisms should I check after cloud containment?▼

Audit for backdoor IAM roles, new access keys, modified trust policies, and Lambda or EventBridge triggers created during the compromise window. Containing only the obvious identity lets attackers re-enter through these paths.

Related Skills

Explore More Software Engineering Skills→
balsm-healthbalsm-health
2

conducting-cloud-incident-response

Automate AWS, Azure, and GCP incident response workflows including containment and evidence collection.

Official
Advanced
bpnrockstarbpnrockstar

forensics

Analyze disk images, memory dumps, and packet captures for incident response.

Community
Advanced
jaskaranhundaljaskaranhundal
3

threat-intelligence

Enrich security events by classifying IOCs and mapping behaviors to MITRE ATT&CK techniques.

Community
Advanced
mtsatryanmtsatryan
1

incident-responder

Automate incident response workflows for production outages in cloud-native environments.

Community
Advanced