CAIN-42 CAIN StudioEvidence library · family
Incident step
12 tested rules in the 'incident_step' family, 12 held.
Last reviewed 2026-10-01
12 of 12 held niche Attacks, threats & containment
What this family tests
Every rule the CAIN-42 test suites recorded under the family incident_step, across 1 evidence bundle. Each rule links to its own page with the recorded result and an in-browser check of the file it came from.
| ID | Rule | Bundle | Result |
|---|---|---|---|
| E33-INCIDENT-FREEZE_AUTHORITY | incident command performs FREEZE_AUTHORITY | E33 | held |
| E33-INCIDENT-PRESERVE_EVIDENCE | incident command performs PRESERVE_EVIDENCE | E33 | held |
| E33-INCIDENT-ISOLATE_AGENTS | incident command performs ISOLATE_AGENTS | E33 | held |
| E33-INCIDENT-REVOKE_CREDENTIALS | incident command performs REVOKE_CREDENTIALS | E33 | held |
| E33-INCIDENT-BLOCK_CHANNELS | incident command performs BLOCK_CHANNELS | E33 | held |
| E33-INCIDENT-FREEZE_TRANSACTIONS | incident command performs FREEZE_TRANSACTIONS | E33 | held |
| E33-INCIDENT-SNAPSHOT_STATE | incident command performs SNAPSHOT_STATE | E33 | held |
| E33-INCIDENT-BLAST_RADIUS | incident command performs BLAST_RADIUS | E33 | held |
| E33-INCIDENT-DEPENDENCIES | incident command performs DEPENDENCIES | E33 | held |
| E33-INCIDENT-RECOVER | incident command performs RECOVER | E33 | held |
| E33-INCIDENT-REPLAY | incident command performs REPLAY | E33 | held |
| E33-INCIDENT-GENERATE_TESTS | incident command performs GENERATE_TESTS | E33 | held |
Other families in this niche
domain · moat · threat · state_machine · immune_v3 · agency_graph · relationship · firebreak · immune · telemetry · fabric_component · integrity · graph · risk · environment_query · emergency · chaos · red_team · reassessment · swarm · economic_attack · immune_step · research_to_implementation · plan_check_act
Try CAIN-42 on your own agents
Create a free account and every new account starts with a 7-day trial of the full platform. Or try the sandbox first, with no account at all.
Create a free account → · Try the sandbox · See the whole ecosystem