# Turn evidence into a response plan

> Use Oyster to turn incident evidence into a response plan — establish what happened, contain, eradicate and recover, then harden.

Source: https://documentation.redorca.ai/guides/blue-team/response-plans/
Last updated: 2026-11-01

1. **Establish what happened** from the evidence: the timeline, the affected assets, the indicators.
2. **Contain:** what to isolate or block now.
3. **Eradicate and recover:** remove the foothold and restore safely.
4. **Harden:** the detection and configuration changes that stop a repeat, each one testable.

Ask Oyster for each step with the case's facts in the question — "Given this timeline and these indicators, what should we contain first and why?" — or attach a **playbook** to the case in [SOC Copilot](https://documentation.redorca.ai/guides/blue-team/soc-copilot/) and work through its steps.

:::caution
Oyster is not a substitute for professional incident response. For a live incident with real impact, involve your incident response team or provider.
:::