--- title: "#incident-response articles | Hashnode" description: "Explore 286 articles tagged #incident-response on Hashnode. Tutorials, guides, and how-tos from the community." url: "https://hashnode.com/tag/incident-response" --- Tag # #incident-response 286 posts · 29 followers [Damiano Bianda](https://hashnode.com/@damianobianda) · [1d ago](https://hashnode.com/posts/the-vendor-pulled-its-own-cloud-offline-what-able2shell-really-tells-us/6af2ed0482596ba802d2a2ba) ### [The Vendor Pulled Its Own Cloud Offline: What Able2Shell Really Tells Us](https://damianobianda.hashnode.dev/the-vendor-pulled-its-own-cloud-offline-what-able2shell-really-tells-us?utm_source=hashnode&utm_medium=feed) On Sunday night, November 8, an independent security researcher named Sean Bales published a GitHub repository called Able2Shell: 33 alleged zero-day vulnerabilities in N-able's N-central platform, co 6 min read · [damianobianda.hashnode.dev](https://damianobianda.hashnode.dev/the-vendor-pulled-its-own-cloud-offline-what-able2shell-really-tells-us?utm_source=hashnode&utm_medium=feed) [Daanial Farrukh](https://hashnode.com/@daanial) · [2d ago](https://hashnode.com/posts/dozens-of-vpn-credentials-in-a-leak-what-to-do-in-the-first-24-hours/6af207f4bffefde2550a2c3d) ### [Dozens of VPN Credentials in a Leak — What to Do in the First 24 Hours](https://quabin.hashnode.dev/dozens-of-vpn-credentials-in-a-leak-what-to-do-in-the-first-24-hours?utm_source=hashnode&utm_medium=feed) Your domain is in a VPN credential leak. Patching will not save you. First 24 hours: kill sessions, rotate, hunt persistence, close the source. 12 min read · [quabin.hashnode.dev](https://quabin.hashnode.dev/dozens-of-vpn-credentials-in-a-leak-what-to-do-in-the-first-24-hours?utm_source=hashnode&utm_medium=feed) [SelfHealing](https://hashnode.com/@selfhealing) · [2d ago](https://hashnode.com/posts/your-ai-agent-will-have-an-incident-here-s-the-15-minute-response-plan/6af185851085047c4da029df) ### [Your AI Agent Will Have an Incident. Here's the 15-Minute Response Plan](https://selfhealing.hashnode.dev/your-ai-agent-will-have-an-incident-here-s-the-15-minute-response-plan?utm_source=hashnode&utm_medium=feed) A no-code incident routine for founders and small teams: severity in two minutes, a containment ladder, customer corrections that don't make things worse, and postmortems that change controls instead of prompts. 8 min read · [selfhealing.hashnode.dev](https://selfhealing.hashnode.dev/your-ai-agent-will-have-an-incident-here-s-the-15-minute-response-plan?utm_source=hashnode&utm_medium=feed) [1](https://hashnode.com/posts/your-ai-agent-will-have-an-incident-here-s-the-15-minute-response-plan/6af185851085047c4da029df) [Ginny Ibe](https://hashnode.com/@ginnyibe) · [4d ago](https://hashnode.com/posts/my-kubernetes-cluster-disappeared-rebuilding-it-changed-how-i-troubleshoot/6aef1de28d6aa32adb2d53b1) ### [My Kubernetes Cluster Disappeared. Rebuilding It Changed How I Troubleshoot.](https://ginnyibe.hashnode.dev/my-kubernetes-cluster-disappeared-rebuilding-it-changed-how-i-troubleshoot?utm_source=hashnode&utm_medium=feed) Lessons from Kubernetes Week 12: rebuilding AWS EKS, troubleshooting node groups developing an evidence-based AI incident-response workflow. 3 min read · [ginnyibe.hashnode.dev](https://ginnyibe.hashnode.dev/my-kubernetes-cluster-disappeared-rebuilding-it-changed-how-i-troubleshoot?utm_source=hashnode&utm_medium=feed) [1](https://hashnode.com/posts/my-kubernetes-cluster-disappeared-rebuilding-it-changed-how-i-troubleshoot/6aef1de28d6aa32adb2d53b1) [SIS Certifications](https://hashnode.com/@siscertifications1) · [Nov 4](https://hashnode.com/posts/cert-in-s-6-hour-rule-and-iso-27001-logging-and-incident-controls-engineers-can-build/6aeb0cd4687b0c9b1651df77) ### [CERT-In’s 6-Hour Rule and ISO 27001: Logging and Incident Controls Engineers Can Build](https://sis-cert.hashnode.dev/cert-in-s-6-hour-rule-and-iso-27001-logging-and-incident-controls-engineers-can-build?utm_source=hashnode&utm_medium=feed) The 2022 CERT-In directions set two clocks for Indian organisations: six hours to report, 180 days of logs. Here’s where ISO/IEC 27001:2022 controls help. 4 min read · [sis-cert.hashnode.dev](https://sis-cert.hashnode.dev/cert-in-s-6-hour-rule-and-iso-27001-logging-and-incident-controls-engineers-can-build?utm_source=hashnode&utm_medium=feed) [Cyber Knight](https://hashnode.com/@cyberknight2479) · [Nov 2](https://hashnode.com/posts/they-couldn-t-prove-the-server-was-clean-so-they-rebuilt-it-from-scratch/6ae8354bd3cace28c9a0cadf) ### [They Couldn't Prove the Server Was Clean — So They Rebuilt It From Scratch](https://nulltrace.hashnode.dev/they-couldn-t-prove-the-server-was-clean-so-they-rebuilt-it-from-scratch?utm_source=hashnode&utm_medium=feed) Alpine Linux faced a CVSS 10.0 GitLab flaw, eight crashed workers, and a gap in its own evidence. Its answer was the hardest call in incident response. 5 min read · [nulltrace.hashnode.dev](https://nulltrace.hashnode.dev/they-couldn-t-prove-the-server-was-clean-so-they-rebuilt-it-from-scratch?utm_source=hashnode&utm_medium=feed) [Mahima Singh](https://hashnode.com/@smahima) · [Nov 1](https://hashnode.com/posts/the-ghost-in-the-apache-debugging-a-mystery-cron-job-across-250-legacy-ec2-instances/6ae725bc713143a41082216c) ### [The Ghost in the Apache: Debugging a Mystery Cron Job Across 250+ Legacy EC2 Instances](https://smahima.hashnode.dev/the-ghost-in-the-apache-debugging-a-mystery-cron-job-across-250-legacy-ec2-instances?utm_source=hashnode&utm_medium=feed) Hidden hourly script was undoing our fixes, and it had been waiting in a Golden AMI for years. 8 min read · [smahima.hashnode.dev](https://smahima.hashnode.dev/the-ghost-in-the-apache-debugging-a-mystery-cron-job-across-250-legacy-ec2-instances?utm_source=hashnode&utm_medium=feed) [1](https://hashnode.com/posts/the-ghost-in-the-apache-debugging-a-mystery-cron-job-across-250-legacy-ec2-instances/6ae725bc713143a41082216c) [bo](https://hashnode.com/@cicada-369) · [Oct 31](https://hashnode.com/posts/one-ip-five-sources-what-a-malicious-address-actually-proves/6ae6409bc7a9383695506502) ### [One IP, Five Sources: What a Malicious Address Actually Proves](https://bokaung.hashnode.dev/one-ip-five-sources-what-a-malicious-address-actually-proves?utm_source=hashnode&utm_medium=feed) Investigating threat actor IP before adding it to a WAF block list: five sources, three answers, two silences, and the limits of an IP verdict. 9 min read · [bokaung.hashnode.dev](https://bokaung.hashnode.dev/one-ip-five-sources-what-a-malicious-address-actually-proves?utm_source=hashnode&utm_medium=feed) [3](https://hashnode.com/posts/one-ip-five-sources-what-a-malicious-address-actually-proves/6ae6409bc7a9383695506502) [Kazem Mortazavi](https://hashnode.com/@kazem-mortazavi) · [Nov 1](https://hashnode.com/posts/managed-detection-and-response-why-unwatched-security-tools-are-only-half-the-job/6ae6b5295a06570d2eaa4e25) ### [Managed Detection and Response: Why Unwatched Security Tools Are Only Half the Job](https://securityland.hashnode.dev/managed-detection-and-response-why-unwatched-security-tools-are-only-half-the-job?utm_source=hashnode&utm_medium=feed) It is 3 a.m. on a Friday and the security console shows a critical alert. The simple question is: who sees it? Many organizations have bought a firewall, EDR and even a SIEM, but nobody sits in front 2 min read · [securityland.hashnode.dev](https://securityland.hashnode.dev/managed-detection-and-response-why-unwatched-security-tools-are-only-half-the-job?utm_source=hashnode&utm_medium=feed) [Cyber Knight](https://hashnode.com/@cyberknight2479) · [Oct 30](https://hashnode.com/posts/they-patched-gitlab-the-bug-stayed/6ae4416e750d1b17018df4f8) ### [They Patched GitLab. The Bug Stayed.](https://nulltrace.hashnode.dev/they-patched-gitlab-the-bug-stayed?utm_source=hashnode&utm_medium=feed) Alpine Linux did the responsible thing — it upgraded on time — and stayed vulnerable for four more days. The fix was never in GitLab's code at all. 6 min read · [nulltrace.hashnode.dev](https://nulltrace.hashnode.dev/they-patched-gitlab-the-bug-stayed?utm_source=hashnode&utm_medium=feed)