---
title: ToolRouter — Workflow
description: A multi-tool workflow showing how to combine ToolRouter tools for a complex task.
url: https://toolrouter.com/workflows/data-breach-response
---
# Data Breach Response

Respond to data breaches by identifying the attack vector, verifying infrastructure integrity, tracing attacker IPs, and monitoring exposure.

A data breach demands immediate, structured response to contain damage, identify the attack vector, and assess the scope of exposure. The first hours after breach discovery are critical for limiting data loss and meeting regulatory notification requirements.

This workflow supports breach response by identifying the likely exploitation vector through vulnerability analysis, verifying infrastructure integrity to detect ongoing compromise, tracing attacker infrastructure through IP geolocation, and monitoring for data exposure on the open web. It provides the intelligence needed for incident reports, regulatory notifications, and remediation planning.

**Tools:** vulnerability-database, dns-domain, web-search, ip-geolocation
**Category:** security

## Steps

### 1. Identify Breach Vector

Search for vulnerabilities in affected systems to identify the most likely breach vector and exploitation method.

- **Tool:** vulnerability-database
- **Skill:** search_vulnerabilities
- **Input:** Software and service versions running on breached systems.
- **Output:** Candidate vulnerabilities with exploit availability, attack vectors, and CVSS scores.

### 2. Check Infrastructure Integrity

Verify DNS records have not been tampered with and no unauthorized redirections or mail routing changes have been made.

- **Tool:** dns-domain
- **Skill:** lookup_dns
- **Input:** Domain to verify DNS integrity after breach discovery.
- **Output:** Current DNS records for comparison against known-good configuration baselines.

### 3. Trace Attacker Infrastructure

Geolocate IP addresses found in logs to identify attacker infrastructure and geographic origin of the breach.

- **Tool:** ip-geolocation
- **Skill:** lookup
- **Input:** Suspicious IP addresses extracted from server logs and access records.
- **Output:** Geographic locations, ISPs, and hosting providers associated with attacker IPs.

### 4. Monitor Breach Exposure

Search for leaked data, paste sites, and underground forums to assess the extent of data exposure from the breach.

- **Tool:** web-search
- **Skill:** search
- **Input:** Organization name, breach indicators, and data identifiers to search for exposure.
- **Output:** References to leaked data, paste site entries, and public mentions of the breach.

## Benefits

- Rapidly identify the exploitation vector through vulnerability analysis
- Detect ongoing compromise through DNS and infrastructure integrity checks
- Trace attacker infrastructure for attribution and law enforcement referral
- Monitor for data exposure to assess breach scope and impact
