Once an ITDR incident is marked contained, new signals on the same identity don’t trigger any further SOC action. In our case, 21 new signals dated after containment were added to a contained critical incident, including an attacker sign-in, and no SOC action was visible to us. We only found out because we reviewed it ourselves, and we had delayed our response because we’d been told the account was contained.

Huntress should treat new signals dated after containment as a potential containment failure and have the SOC re-evaluate. The partner should be notified again if the identity is still showing attacker activity, because that warrants immediate action.