AISI’s post-incident controls: sever internet egress first, then watch the agent
Posts here