Incident Response

Use this guide during active fleet incidents.

Immediate actions

1. Freeze rollout expansion.
2. Isolate affected smart groups.
3. Collect endpoint health snapshots and install/runtime logs.
4. Execute rollback if SLOs remain breached.
5. Track all actions in the incident ticket.

Evidence to collect

• Jamf or Intune policy and profile history.
• Package version, signature, and checksum records.
• Endpoint registration and check-in evidence.
• Key rotation or revocation events with actor and timestamp.
• Rollback evidence and recovery verification.

Recovery validation

thoth health --json

Confirm:

• Endpoint registration and check-in are healthy.
• Current version and policy profile are correct.
• No unresolved P0 or P1 deployment blockers remain.