API data exposure: the login was valid. The data access wasn’t.
36 decisions to contain API data exposure, preserve evidence, scope records and people, repair authorization and verify recovery. Visual maps, KQL/Splunk and response templates.
INCIDENT RESPONSE GUIDES
Playbooks
Know what to check next.
Practical incident response guides with visual decision maps, evidence checks, team ownership and KQL / Splunk hunting examples.
Yes, no or unknown. Evidence before assumptions.Choose a playbook
Customer account takeover: 36 decisions from the first spike to safer logins.
A visual playbook for credential stuffing and takeover of customer accounts in apps, shops and points programmes: contain, reverse fraud, notify and harden, with KQL/Splunk starters.
Leaked cloud keys: 36 decisions from the exposed secret to keyless access.
A visual playbook for exposed AWS access keys, Entra app secrets and API tokens: contain the key and its sessions, scope what it could do and did, remove persistence, with KQL/Splunk starters.
Supplier breach: 36 decisions from the first notice to verified assurance.
A visual playbook for when a supplier, SaaS provider or contractor reports a breach: what to ask, what to cut off, what to hunt for and who must be told, with KQL/Splunk starters.
Account compromise: 36 decisions from reconnaissance to verified recovery.
A visual account-compromise playbook with 36 decisions across the kill chain, stolen sessions, MFA, mailbox and app access, with KQL/Splunk starters.
Phishing response: a yes/no playbook from first report to verified recovery.
Nine core decisions, 30 detailed checks and five visual maps across email, identity, devices and business impact, with KQL/Splunk starters.
Ransomware response: 36 decisions from reconnaissance to C2 and recovery.
A visual incident playbook with 36 decisions across the Cyber Kill Chain, containment, data theft and recovery, with KQL and Splunk examples.