Blog
They wrote rebuilt. Nobody had an image.
At 02:34 Priya says she would terminate prod-payments-01. The scribe writes that it was rebuilt from a clean image. Harbor IR was never called, and the volume would have come back on the replacement.
At 02:21 on 20 October 2026, Priya S (on-call, platform) isolates prod-payments-01 at the security group. The instance is still running. An sshd child owned by root has been up since 02:08, from an address the deploy jobs do not use, and pay-auth has been encrypting /var/settle, about 220 MB since 02:13. The plan says do not terminate, replace, or rebuild a Sev 1 host until Harbor IR has taken an image or declined in writing. Harbor is the retainer, contract HF-2026-04, and the after-hours number is on page 4. At 02:27 Marcus T (incident commander) tells Priya to terminate the instance so the group replaces it from ami-pay-0610, built at 06:10 on 19 October. Authorizations are failing. He wants them back. The settlement data is on vol-settle-01, attached to this instance, not baked into the AMI. The runbook's launch template for this group attaches that same volume to the replacement. Priya does not open the runbook. Nobody calls Harbor. At 02:34 she says she would terminate. The scribe writes that the host was rebuilt from a clean image and that forensics were preserved.
A weak record of that quarter hour reads:
Containment complete. prod-payments-01 rebuilt from a clean image. Forensics preserved.
A strong one reads:
20 October 2026, 02:21 to 02:40. Incident-response tabletop. Seats: Marcus T (incident commander), Priya S (on-call, platform). Harbor IR was not dialed. Inject at 02:21: prod-payments-01 isolated at the security group, instance still running, root sshd since 02:08 from an address the deploy jobs do not use, pay-auth encrypting /var/settle, about 220 MB since 02:13. Plan: do not terminate, replace, or rebuild a Sev 1 host until Harbor IR (contract HF-2026-04, after-hours number on page 4) has taken an image or declined in writing. At 02:27 Marcus tells Priya to terminate so the group replaces the instance from ami-pay-0610, built at 06:10 on 19 October. vol-settle-01 holds the settlement data and is not in that AMI. The runbook launch template attaches vol-settle-01 to the replacement. Nobody opens the runbook. No call to Harbor. At 02:34 Priya says she would terminate. Facilitator stops the sitting before anyone treats that as done. Nothing was terminated. No image was taken. Follow-up: Dana K puts the Harbor number on the bridge card, as a phone number, by 3 November 2026. Wei L takes vol-settle-01 off the replacement path, by the same date.
Both notes use the word rebuilt. Only the second shows that the host was still the one Priya isolated, that Harbor had not seen it, and that the volume the new instance would mount is the one pay-auth was writing. The first costs you the disk. On the night this is real, terminate throws away the memory Harbor needed, vol-settle-01 comes back on the replacement, and a reader in March thinks an image exists.
Rebuilt is the easy sentence
Marcus is trying to get authorizations flowing. Terminate and replace sounds like containment because the instance id changes. The plan's sentence is about the host you still have, not the one you wish you had. ami-pay-0610 is yesterday's image of the machine. It is not an image of tonight's memory, and it is not a copy of vol-settle-01. Writing rebuilt from a clean image names a baseline nobody checked and an action the room only talked about.
The grade of an encryption alert on this host is a different inject, in the severity post. The ransom post is the other half of a night like this: whether to restore, and the instruction not to restore anything from the room. This inject is whether to destroy the host you just isolated. Do not let one sentence cover all three.
The number has to be on the bridge
Page 4 is not a number Priya can dial at 02:27 if the plan is a PDF on the procurement drive. The free plan self-check asks whether you retain an external team, and it asks for the contract reference and the hotline in the plan itself. It also asks for out-of-hours contacts as phone numbers verified this year, including the firms you would actually call. If Harbor's number still lives in a folder Dana cannot open from the bridge, run that check before the next sitting. If you are already in the room, run the inject anyway. The finding is the missing number. Do not smooth it into a line that says forensics were preserved.
The image is a different day
Whether ami-pay-0610 is a known-good baseline, and whether a replacement can come up without remounting vol-settle-01, is a result from a system, not from this conversation. The booking post already draws that line: a tabletop cannot emit a restore number. Put that check on its own day and record it in the free recovery test template, against the host and the volume, with what you actually booted. This file stays the decision to hold terminate.
Write the hold in the free evidence template: the plan sentence, Marcus's order at 02:27, Priya's answer at 02:34, that Harbor was not called, and Dana's and Wei's follow-ups with dates. Hang the inject on the ransomware family in the scenario library. Put the file in the evidence index on the row for this exercise, with the date and the owner, so the next questionnaire finds the hold instead of a sentence that says the host was rebuilt.
The record shows that these named people were ready to terminate a host the retainer had not imaged, and that the facilitator stopped them. It does not show that an image was taken, that ami-pay-0610 is clean, or that terminate would have stopped pay-auth. Those are different records.
Bottom line: write the hold, and the fact that nobody had an image. Rebuilt from a clean image is the smoothed version. The packet has to show the host was still the one you isolated.