Skip to content
Arbitex Docs

Incident Response Playbooks

This section contains 12 incident response playbooks covering the most critical security scenarios for the Arbitex platform. Each playbook follows a standardized 8-section format designed for rapid execution during an active incident.

These procedures are rendered in the Staff UI Playbook Library (visible to engineering and admin roles) and are designed to be executed by an Incident Commander — a time-limited escalation role granted during an active incident.

Playbook format

Section titled “Playbook format”

Every playbook follows the same structure:

Section Purpose
Detection How this incident is discovered — specific alerts, customer reports, and audit anomalies
Severity classification When and how to escalate — specific thresholds and criteria
Immediate actions First 15 minutes — step-by-step checklist with specific API calls and Staff UI actions
Investigation What to examine — audit log filters, database queries, log searches
Containment How to limit blast radius — specific emergency controls to activate
Recovery Steps to restore normal operation — rollback procedures, verification checks
Communication Who to notify and when — notification templates for customers, legal, and management
Post-incident Evidence preservation, timeline reconstruction, and lessons learned

Scenario index

Section titled “Scenario index”
ID Scenario Default severity Page
IR-1 Compromised tenant account HIGH IR-1: Compromised Tenant Account
IR-2 Compromised API key HIGH IR-2: Compromised API Key
IR-3 DLP bypass detected CRITICAL IR-3: DLP Bypass Detected
IR-4 Outpost compromise CRITICAL IR-4: Outpost Compromise
IR-5 Database breach suspected CRITICAL IR-5: Database Breach Suspected
IR-6 Model tampering suspected HIGH IR-6: Model Tampering Suspected
IR-7 HMAC chain break detected HIGH IR-7: HMAC Chain Break Detected
IR-8 Redis compromise MEDIUM IR-8: Redis Compromise
IR-9 Certificate compromise HIGH IR-9: Certificate Compromise
IR-10 Mass credential breach (CredInt alert) CRITICAL IR-10: Mass Credential Breach
IR-11 Supply chain attack (dependency) CRITICAL IR-11: Supply Chain Attack
IR-12 Insider threat CRITICAL IR-12: Insider Threat

Incident Commander role

Section titled “Incident Commander role”

The Incident Commander (IC) is a time-limited escalation role, not a permanent staff role. Key properties:

  • Activation: Declared via Staff UI by an engineering or admin staff member
  • Duration: 1-hour default, extendable in 1-hour increments, 24-hour maximum
  • Audit: Every IC action logged as high-severity audit event with incident ID correlation
  • Deactivation: Auto-expires at the end of the time window, or manually closed when resolved
  • Who can grant: admin role only (or self-grant for admin users)

The IC role grants access to emergency controls not available to the normal engineering role:

Emergency control Staff API endpoint
Tenant isolation POST /api/staff/emergency/tenant/isolate
Bulk credential revocation POST /api/staff/emergency/credentials/revoke-all
Feature kill switch POST /api/staff/emergency/killswitch
Outpost disconnect POST /api/staff/emergency/outpost/disconnect
Audit log freeze POST /api/staff/emergency/audit/freeze

All emergency endpoints require an active IC role, create high-severity audit events, send notifications to all admin-role staff, and are idempotent (safe to call twice).

Section titled “Related documentation”