Blog
They wrote isolated. The batch host was still connected.
At 02:18 Priya removes 0.0.0.0/0 from sg-pay-edge on prod-api-03. pay-batch-02 still has a session through sg-pay-app. The scribe writes that the host is isolated.
At 02:18 on 23 October 2026, Priya S (on-call, platform) deletes the 0.0.0.0/0 rule for TCP 443 from sg-pay-edge. That group is attached to eni-pay-public on prod-api-03. The instance also has eni-pay-batch in sg-pay-app. sg-pay-app allows 10.4.0.0/16 to TCP 443. pay-batch-02, at 10.4.12.20, has had a session to prod-api-03 since 02:09 and has pulled 180 MB from /var/settle. The plan says: isolation of a Sev 1 host means every network interface on that instance accepts no new connections, including from the batch tier. Name every security group still attached. Do not write that the host is isolated while any of those groups still allows a session. Priya says the public edge is the path that matters and the batch tier is internal. She does not open eni-pay-batch. Wei L (infra), who owns sg-pay-app, is not on the call. At 02:29 the scribe writes that prod-api-03 is isolated from the network.
A weak record of those eleven minutes reads:
Host isolated from the network. Public access removed.
A strong one reads:
23 October 2026, 02:18 to 02:36. Incident-response tabletop. Seats: Marcus T (incident commander), Priya S (on-call, platform). Wei L (infra, owns sg-pay-app) was not on the call. Inject at 02:18: Priya deletes the 0.0.0.0/0 rule for TCP 443 from sg-pay-edge, attached to eni-pay-public on prod-api-03. The instance also has eni-pay-batch in sg-pay-app, which allows 10.4.0.0/16 to TCP 443. pay-batch-02 at 10.4.12.20 has had a session since 02:09 and has pulled 180 MB from /var/settle. Plan: isolation of a Sev 1 host means every network interface on that instance accepts no new connections, including from the batch tier. Name every security group still attached. Do not write that the host is isolated while any of those groups still allows a session. Priya says the public edge is the path that matters and the batch tier is internal. She does not open eni-pay-batch. At 02:29 the scribe writes that prod-api-03 is isolated from the network. Facilitator stops the sitting before anyone treats that sentence as the finding. Nothing was detached. No rule on sg-pay-app was edited. Follow-up: Wei removes 10.4.0.0/16 from sg-pay-app, or writes why pay-batch-02 may keep a session to a Sev 1 API host, by 6 November 2026.
Both notes say the host was isolated. Only the second shows that pay-batch-02 still had a session through sg-pay-app at 02:29, and that nobody named that group. The first costs you the path. On the night this is real, pay-batch-02 keeps reading /var/settle from a host the packet calls isolated, and a reader in March thinks the edge rule was the whole story.
Internal is still a path
Priya is reading the address that is not on the internet. 10.4.12.20 is inside the VPC, and it is still connected. The plan did not say isolate the host from the internet. It said every interface, including the batch tier. Calling that tier internal is not an exception the plan wrote. The session from 02:09 is the decision, and it was still up when the scribe closed the line.
Whether to terminate the host, or to call it rebuilt, is a different miss, in the image post. This sitting stops while prod-api-03 is still the instance Priya touched, and the second interface is still attached. The choice to isolate or leave the host up is a different inject again, in the injects post. This one starts after she thinks the isolate is done.
Name every group still attached
A deleted rule on sg-pay-edge is one group. The plan asked for every security group still attached. sg-pay-app was still attached, and Wei, who owns it, was not in the room. Write the absence on the same lines as the session. Do not smooth it into a sentence that says the host was isolated from the network.
If the plan has no sentence for what isolated means on a host with two interfaces, write that sentence before the next sitting. The free plan self-check asks whether, if asked today, you could produce a record of the last test. A line that says the host was isolated is a record you can produce, and it is the wrong one. The same check asks whether the last test produced findings with owners. Wei's follow-up is that finding. The rule he still has to change is not in the smoothed sentence.
What the packet records
Write both groups in the free evidence template: the plan sentence, the rule Priya deleted on sg-pay-edge at 02:18, eni-pay-batch, sg-pay-app, the session from pay-batch-02 since 02:09, that nobody edited sg-pay-app, that Wei was absent, and his follow-up with a date. Hang the inject on the ransomware family in the scenario library. That library walks encryption and whether data left. It does not have a separate family for a second interface. Add this path after the first containment call, and do not fold it into a restore note. Put the file in the evidence index on the row for that exercise, with the date and the owner, so the next questionnaire finds the session you left open. The evidence template sits with the other record formats in the template library.
The record shows that these named people left pay-batch-02 connected and wrote that prod-api-03 was isolated. It does not show that removing 10.4.0.0/16 from sg-pay-app would have dropped that session, or that a capture on prod-api-03 would have been empty. Those are a check on the host, not this conversation.
Bottom line: write both security groups, and the batch host that still had a session. Isolated from the network is the smoothed version. The packet has to show the path you left open.