CISA Unveils Eviction Strategies Tool to Boost Cyber Incident Response

CISA's new tool speeds up incident response. It's designed to help cyber defenders craft detailed playbooks in minutes, reducing dwell time and limiting damage.

, and Administrator

2025 October 28 . 3:18 AM

1 min read

In the center of the image a graffiti is present on the wall. At the bottom of the image floor is... — In the center of the image a graffiti is present on the wall. At the bottom of the image floor is there.

CISA Unveils Eviction Strategies Tool to Boost Cyber Incident Response

The US Cybersecurity and Infrastructure Security Agency (CISA) has launched a new tool, the Eviction Strategies Tool, to bolster cyber incident response. This free resource, developed in collaboration with MITRE, helps organizations swiftly remove adversaries from compromised systems and strengthen overall cybersecurity posture. The tool integrates two key resources: COUN7ER, a comprehensive database of over 100 post-compromise countermeasures, and the Cyber Eviction Strategies Playbook NextGen, a user-friendly web interface for aligning incident findings with recommended cybersecurity strategies. The tool supports the use of structured frameworks like MITRE ATT&CK or free-text descriptions of threat behavior for developing response plans. CISA invites public and private sector organizations to incorporate the tool into their cybersecurity incident response workflows and provide feedback via an anonymous survey. The tool offers capabilities such as exporting plans in various formats and integrating knowledge from frameworks like MITRE D3FEND. It is designed for ease of use and speed, allowing cybersecurity defenders to craft detailed playbooks for containing and removing threat actors in minutes. CISA emphasizes the importance of the tool in addressing long-standing challenges faced by cyber incident responders and leveling the playing field for cybersecurity defenders. The launch of the Eviction Strategies Tool is a strategic step by CISA to enhance nationwide cyber-resilience, particularly against state-sponsored cybersecurity threats like Volt Typhoon and APT29. By reducing dwell time of attackers and limiting damage, the tool helps organizations strengthen their overall cybersecurity posture and optimize cyber incident response.