SKILL.md
D3FEND — Restore
When to Use
- Restoring user access after incident containment (reissue credentials, unlock accounts)
- Recovering files, databases, and configurations from backup
- Rebuilding systems from disk images or clean baselines
- Restoring email and software after malware removal
- Validating restored systems before returning to production
- Documenting recovery actions for post-incident review
When NOT to Use
- Active incident containment or eviction →
d3fend-evict - Detection engineering or monitoring →
d3fend-detect - Hardening to prevent future incidents →
d3fend-harden - Backup strategy design →
infrastructure-engineer - Business continuity planning →
cybersecurity
Core Workflows
1. Restore Access
| Action | Steps |
|---|---|
| Reissue credential | Generate new token/cert/password; distribute securely |
| Unlock account | Verify identity; reset MFA if compromised |
| Restore network access | Re-enable firewall rules; verify no persistence |
| Restore user account access | Validate AD/Azure AD; check group memberships |
See references/restore_access.md
2. Restore Objects
- Restore file (from backup, shadow copy, or clean source)
- Restore email (from archive or backup)
- Restore database (point-in-time recovery, transaction log replay)
- Restore disk image (bare metal restore, VM snapshot)
- Restore configuration (from version control or backup)
See references/restore_objects.md
3. Restore Software & Systems
- Reinstall software from trusted source
- Rebuild system from hardened gold image
- Verify integrity (hash check, signature validation)
- Re-apply patches and updates
- Re-run vulnerability scan before rejoining network
See references/restore_systems.md
When to load references
- Restore access →
references/restore_access.md - Restore objects →
references/restore_objects.md - Restore systems →
references/restore_systems.md