Versions Compared


  • This line was added.
  • This line was removed.
  • Formatting was changed.
Comment: Fix wrong heading on the PDF file


The following table describes the actions to be taken when an incident potentially affecting EGI users, data, services, infrastructure is suspected. Administrators are recommended to take note of every action (with timestamp) they take, for later analysis or legal cases.

1Inform your local security team, your NGI Security Officer and the EGI CSIRT via You are encouraged to use the recommended templates.Within 4 hours of discovery
2In consultation with your local security team and the EGI CSIRT, act to isolate the compromised systems and contain the incident whilst preserving forensic data. Take a snapshot of affected VMs. Isolate at the network level if possible. Do NOT reboot or power off hosts. Do NOT destroy VMs. Physically disconnect systems from the network ONLY where other options are not available.Within 1 day of discovery
3Together with your local security team and the EGI CSIRT decide if it is an incident that requires further investigation or action.
4If applicable, announce downtime for the affected services in accordance with the EGI Operational ProceduresWithin 1 day of isolation
5Perform appropriate analysis and take necessary corrective actions, seeIncident Analysis GuidelineWithin 4 working hours of any EGI CSIRT request

Coordinate with your local security team and the EGI CSIRT to send an incident closure report to the EGI CSIRT via, including lessons learnt and resolution. This report should be labelled AMBER or RED, according to the Traffic Light Protocol.

Within 1 month of incident resolution
7Restore the service and, if needed, update the service documentation and procedures to prevent recurrence as necessary.

Resource Centre Checklist

View file

EGI-CSIRT Responsibilities