Turn evidence into a response plan
- Establish what happened from the evidence: the timeline, the affected assets, the indicators.
- Contain: what to isolate or block now.
- Eradicate and recover: remove the foothold and restore safely.
- Harden: the detection and configuration changes that stop a repeat, each one testable.
Ask Oyster for each step with the case’s facts in the question — “Given this timeline and these indicators, what should we contain first and why?” — or attach a playbook to the case in SOC Copilot and work through its steps.
Oyster is made by Red Orca, alongside Dolphin and Shark. One account for all three.