A service is being denied

The one incident where the business impact is happening in front of everyone while you work. Restoring service and understanding the attack are separate jobs, and confusing them costs you both.

Trigger. A public service is unreachable or degraded, and the traffic is not yours.

The first 60 minutes0 of 5 expire

01 02 03 04 05

030 min60

01
Confirm it is an attack and not a failure
by 10 min
A bad deployment, an expired certificate and a dependency outage all look like this from the outside. Establish the traffic shape before declaring an attack, because the response is entirely different.
02
Get upstream mitigation engaged
by 20 min
Your provider or scrubbing service absorbs volume that will never be filtered at your own edge. This is a phone call with a contract reference, which is a thing to have found before today.

Tell somebody

The upstream provider, early, because their capacity is the actual mitigation
Executive and communications, since customers notice this one without being told
Anyone whose dependency you are, if the service is one other people build on

Drawn from

The documents these steps come from, so you can check one rather than take it on trust.

Collect it in one go

A read-only script that gathers most of the above in volatility order, with a hash manifest.

Triage collection

Make it yours

Replace the escalation list with real names, and the timings with what your change process actually allows. A playbook that assumes an authority you do not have will stall at the step that needed it.

Confirm it is an attack and not a failure

Get upstream mitigation engaged