# Incident Response

> Respond to active deployment and runtime incidents for Thoth MCP Proxy fleets.

Source: https://docs.atensecurity.com/docs/operations/incidents

Use this guide during active fleet incidents.

## Immediate actions

1. Freeze rollout expansion.
2. Isolate affected smart groups.
3. Collect endpoint health snapshots and install/runtime logs.
4. Execute rollback if SLOs remain breached.
5. Track all actions in the incident ticket.

## Evidence to collect

- Jamf or Intune policy and profile history.
- Package version, signature, and checksum records.
- Endpoint registration and check-in evidence.
- Key rotation or revocation events with actor and timestamp.
- Rollback evidence and recovery verification.

## Recovery validation

```bash
thoth health --json
```

Confirm:

- Endpoint registration and check-in are healthy.
- Current version and policy profile are correct.
- No unresolved P0 or P1 deployment blockers remain.