The most effective first action is to use the Endpoint Detection and Response (EDR) integration to quarantine the compromised asset. This immediately isolates the server from the network, preventing the threat from spreading (lateral movement) or communicating with external command-and-control (C2) servers. Crucially, quarantining preserves the server's current state, including volatile memory and disk artifacts, which are essential for a thorough forensic investigation to understand the full scope of the breach and identify persistence mechanisms. This single action achieves both immediate containment and data preservation.

A. Blocking a single IP address is an incomplete containment strategy; the compromised server could still attack internal systems or communicate with other malicious IPs.

B. Rebooting the server is a destructive action that erases critical volatile evidence (e.g., running processes, network connections, memory contents), violating the forensic preservation requirement.

D. Blocking a single domain is insufficient containment, as attackers often use multiple domains, IP addresses, or other protocols for C2 communication.

1. Google Cloud Documentation

Chronicle SOAR Integrations: Chronicle SOAR integrates with numerous EDR solutions (e.g.

CrowdStrike

SentinelOne

Microsoft Defender for Endpoint). These integrations explicitly provide response actions such as "Network Contain" or "Quarantine Host

" which allow an analyst to isolate a machine directly from the Google SecOps interface. This is a core function of a modern Security Orchestration

Automation

and Response (SOAR) platform. (Reference: See specific EDR integration documentation within the Google Cloud Chronicle documentation

such as the "CrowdStrike Falcon" or "SentinelOne" integration guides which list available actions).

2. NIST Special Publication 800-61 Rev. 2

"Computer Security Incident Handling Guide": This foundational guide outlines the incident response lifecycle. Section 3.3.2

"Containment

" emphasizes that containment is critical for preventing further damage and that a major decision is whether to "disconnect it from a network." EDR quarantine is the modern

forensically-sound method of achieving this disconnection without powering down the system and losing volatile data.

3. Google Cloud Security Foundations Guide

"Incident response": In the section on "Containment strategies" (Page 10)

the guide lists "Isolate the affected systems" as a primary technique. It states

"You can isolate the affected systems from the rest of your environment by using firewall rules or other network access control mechanisms." EDR quarantine is a sophisticated and rapid form of this network isolation.