Security Incident Response
Detect. Contain. Recover.
Tyler Response API is the coordination point for Tyler Technologies security incidents: one place to report a threat, track the response, and keep everyone working from the same timeline.
Think something is wrong right now? Don't wait to be sure. Disconnect the affected device from the network, leave it powered on, and report it immediately. Early reports limit the damage.
The response lifecycle
From first alert to lessons learned
-
01
Prepare
Playbooks, contacts, and tooling ready before the call comes in.
-
02
Detect
Triage alerts and reports, confirm scope, and declare the incident.
-
03
Contain
Isolate affected hosts and accounts to stop the spread.
-
04
Eradicate
Remove the foothold: malware, persistence, and stolen credentials.
-
05
Recover
Restore service safely and watch for the attacker's return.
-
06
Learn
Review the timeline, fix root causes, and update the playbooks.
How we respond
Speed over certainty
Report early. A false alarm costs minutes; a delayed report can cost days of recovery.
Preserve the evidence
Don't wipe, reboot, or "clean up" a suspect system. Logs and memory tell us what happened.
One timeline, one team
Every action is recorded and audited, so responders, leadership, and customers hear the same story.