Return to Question

I suspect that one or more of my servers is compromised by a hacker, virus, or other mechanism:

• What are my first steps? When I arrive on site should I disconnect the server, preserve "evidence", are there other initial considerations?
• How do I go about getting services back online?
• How do I prevent the same thing from happening immediately again?
• Are there best practices or methodologies for learning from this incident?
• If I wanted to put a Incident Response Plan together, where would I start? Should this be part of my Disaster Recovery or Business Continuity Planning?

_{This is meant to be a canonical post for this topic. Originally from serverfault.}

I suspect that one or more of my servers is compromised by a hacker, virus, or other mechanism:

• What are my first steps? When I arrive on site should I disconnect the server, preserve "evidence", are there other initial considerations?
• How do I go about getting services back online?
• How do I prevent the same thing from happening immediately again?
• Are there best practices or methodologies for learning from this incident?
• If I wanted to put a Incident Response Plan together, where would I start? Should this be part of my Disaster Recovery or Business Continuity Planning?

_{This is meant to be a canonical post for this topic. Originally from serverfault.}

I suspect that one or more of my servers is compromised by a hacker, virus, or other mechanism:

• What are my first steps? When I arrive on site should I disconnect the server, preserve "evidence", are there other initial considerations?
• How do I go about getting services back online?
• How do I prevent the same thing from happening immediately again?
• Are there best practices or methodologies for learning from this incident?
• If I wanted to put a Incident Response Plan together, where would I start? Should this be part of my Disaster Recovery or Business Continuity Planning?

_{This is meant to be a canonical question for this topic. Originally from serverfault.}

I suspect that one or more of my servers is compromised by a hacker, virus, or other mechanism:

• What are my first steps? When I arrive on site should I disconnect the server, preserve "evidence", are there other initial considerations?
• How do I go about getting services back online?
• How do I prevent the same thing from happening immediately again?
• Are there best practices or methodologies for learning from this incident?
• If I wanted to put a Incident Response Plan together, where would I start? Should this be part of my Disaster Recovery or Business Continuity Planning?

_{This is meant to be a canonical post for this topic. Originally from serverfault.}

Originally from serverfault.

Canonical Version
I suspect that one or more of my servers is compromised by a hacker, virus, or other mechanism:

• What are my first steps? When I arrive on site should I disconnect the server, preserve "evidence", are there other initial considerations?
• How do I go about getting services back online?
• How do I prevent the same thing from happening immediately again?
• Are there best practices or methodologies for learning from this incident?
• If I wanted to put a Incident Response Plan together, where would I start? Should this be part of my Disaster Recovery or Business Continuity Planning?

I suspect that one or more of my servers is compromised by a hacker, virus, or other mechanism:

• What are my first steps? When I arrive on site should I disconnect the server, preserve "evidence", are there other initial considerations?
• How do I go about getting services back online?
• How do I prevent the same thing from happening immediately again?
• Are there best practices or methodologies for learning from this incident?
• If I wanted to put a Incident Response Plan together, where would I start? Should this be part of my Disaster Recovery or Business Continuity Planning?

_{This is meant to be a canonical question for this topic. Originally from serverfault.}