When you are the SOC: The first 60 minutes of incident response

Most incident response content assumes a SOC, a runbook library, and a manager to escalate to. But across small businesses, startups, schools, and not-for-profits, the reality is different: one sysadmin, one ticking clock, and one chance to contain the damage without destroying the evidence. This session is built for that person.

Through an audience-driven scenario based on a sanitised real identity compromise with early lateral movement indicators, attendees will make first-hour decisions in real time. The session introduces a simple, repeatable loop for solo and small-team responders: Confirm, Contain, Preserve, Communicate.

The session opens by framing the solo operator problem: when there is no SOC, the biggest risk is not the attacker but the responder making panic decisions that widen the blast radius or destroy evidence. The first-hour goal is to reduce harm and preserve options, not solve everything.

Attendees are then introduced to the Confirm, Contain, Preserve, Communicate loop and a live scoreboard tracking three metrics across the scenario: business impact, evidence quality, and speed. The scoreboard keeps the session interactive and gives the audience a tangible way to measure their decisions.

The core of the session is a three-act scenario walkthrough. At each decision point, the audience votes on the next action, and the scenario branches based on their choices:

• Decision Point 1 (Confirm): What to check first to validate the incident without contaminating evidence. The walkthrough covers sign-in logs, session context, suspicious device and application indicators, and audit events. Attendees are prompted to identify the single detail that changes their next step.
• Decision Point 2 (Contain): Choosing the right containment layer (identity, endpoint, or network) and applying safe containment patterns that minimise collateral damage. The session covers session revocation, account disablement, forced MFA reset, and conditional access patterns, all discussed conceptually with no vendor-specific tooling. A "what not to do" segment addresses the most common solo-responder mistakes: (reimaging before preserving logs, disabling accounts without revoking sessions, and isolating endpoints before capturing volatile data).
• Decision Point 3 (Preserve): Collecting minimum viable evidence in the first hour using tools available to teams without specialist forensic capability. Attendees see how to export relevant logs, apply event log filters, capture a triage snapshot (processes, network connections), and pull firewall or proxy logs. The session includes a live demonstration of turning messy signals into a coherent incident timeline using a simple notes template.

The session closes with two communication templates (a technical channel update and a stakeholder update that buys time), a walkthrough of the artefact pack attendees take home, and a 15-minute tabletop drill designed for solo operators or small teams to run the following week.