> For the complete documentation index, see [llms.txt](https://docs.stoik.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.stoik.io/cyber-best-practices/manage-a-cyberattack/incident-response-reflexes.md). # Incident response reflexes When a cyberattack hits, the first minutes decide how bad it gets. The **Incident response reflexes** document is a short, printable guide that tells you what to do, and what never to do, in the moments before the Stoïk CERT takes over the technical response. It covers the reflexes common to every incident, then the specific first actions for the main attack types: ransomware, wire transfer fraud (BEC), data breach, DDoS, and account compromise. {% hint style="info" %} **Download the document:** the Incident response reflexes guide is available in Word (`.docx`), in English, French, German, Dutch and Spanish, on our drive: [Incident response reflexes on Google Drive](https://drive.google.com/drive/folders/1k4ASdhV9mZAOQiV0fucRj8YioHmeoPug?usp=drive_link) {% endhint %} ## The 3 golden rules Taken from the document, these apply to every incident: * **Stay calm.** Rushed decisions almost always make the situation worse. * **Call the Stoïk CERT** before any technical action or external communication. * **Document everything:** time, systems affected, actions already taken. ## Why download it * The actions you take in the first hour shape the entire recovery. They need to be ready, not improvised under pressure. * During a real attack your systems may be down or untrusted. A guide you have already read, and ideally printed, is one you can still use. * It speeds up the call with the CERT: you already know what to isolate, preserve, and report. ## What to do with it 1. Download it and read it before any incident, not during one. 2. Share it with the people who would handle a crisis: IT, management, finance. 3. Keep an offline copy, the same way you keep your BCP/DRP plan. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.stoik.io/cyber-best-practices/manage-a-cyberattack/incident-response-reflexes.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.