mirror of
https://github.com/BagelHole/DevOps-Security-Agent-Skills.git
synced 2026-08-22 12:49:53 +02:00
97 lines
2.2 KiB
Markdown
97 lines
2.2 KiB
Markdown
|
---
|
||
|
|
name: incident-response
|
||
|
|
description: Handle security incidents with IR playbooks and procedures. Implement detection, containment, eradication, and recovery processes. Use when responding to security events or building incident response capabilities.
|
||
|
|
license: MIT
|
||
|
|
metadata:
|
||
|
|
author: devops-skills
|
||
|
|
version: "1.0"
|
||
|
|
---
|
||
|
|
|
||
|
|
# Incident Response
|
||
|
|
|
||
|
|
Handle security incidents effectively with structured response procedures.
|
||
|
|
|
||
|
|
## Incident Response Phases
|
||
|
|
|
||
|
|
```yaml
|
||
|
|
phases:
|
||
|
|
1_preparation:
|
||
|
|
- IR team and contacts
|
||
|
|
- Tools and access ready
|
||
|
|
- Playbooks documented
|
||
|
|
|
||
|
|
2_detection:
|
||
|
|
- Alert triage
|
||
|
|
- Initial assessment
|
||
|
|
- Severity classification
|
||
|
|
|
||
|
|
3_containment:
|
||
|
|
- Short-term containment
|
||
|
|
- Evidence preservation
|
||
|
|
- System isolation
|
||
|
|
|
||
|
|
4_eradication:
|
||
|
|
- Root cause analysis
|
||
|
|
- Remove threat
|
||
|
|
- Patch vulnerabilities
|
||
|
|
|
||
|
|
5_recovery:
|
||
|
|
- System restoration
|
||
|
|
- Monitoring enhanced
|
||
|
|
- Business continuity
|
||
|
|
|
||
|
|
6_lessons_learned:
|
||
|
|
- Post-incident review
|
||
|
|
- Documentation update
|
||
|
|
- Process improvement
|
||
|
|
```
|
||
|
|
|
||
|
|
## Severity Classification
|
||
|
|
|
||
|
|
| Level | Impact | Response Time |
|
||
|
|
|-------|--------|---------------|
|
||
|
|
| Critical | Data breach, full outage | Immediate |
|
||
|
|
| High | Service degraded, potential breach | < 1 hour |
|
||
|
|
| Medium | Limited impact, contained | < 4 hours |
|
||
|
|
| Low | Minimal impact | Next business day |
|
||
|
|
|
||
|
|
## Initial Response Checklist
|
||
|
|
|
||
|
|
```markdown
|
||
|
|
- [ ] Confirm incident is real (not false positive)
|
||
|
|
- [ ] Classify severity level
|
||
|
|
- [ ] Notify IR team
|
||
|
|
- [ ] Begin documentation
|
||
|
|
- [ ] Preserve evidence
|
||
|
|
- [ ] Implement containment
|
||
|
|
- [ ] Communicate to stakeholders
|
||
|
|
```
|
||
|
|
|
||
|
|
## Evidence Collection
|
||
|
|
|
||
|
|
```bash
|
||
|
|
# System state
|
||
|
|
ps aux > /evidence/processes.txt
|
||
|
|
netstat -tuln > /evidence/connections.txt
|
||
|
|
last -a > /evidence/logins.txt
|
||
|
|
|
||
|
|
# Memory dump
|
||
|
|
dd if=/dev/mem of=/evidence/memory.dump
|
||
|
|
|
||
|
|
# Log preservation
|
||
|
|
tar czf /evidence/logs.tar.gz /var/log/
|
||
|
|
```
|
||
|
|
|
||
|
|
## Best Practices
|
||
|
|
|
||
|
|
- Pre-defined playbooks
|
||
|
|
- Regular IR drills
|
||
|
|
- Clear communication channels
|
||
|
|
- Legal team involvement
|
||
|
|
- Post-incident reviews
|
||
|
|
|
||
|
|
## Related Skills
|
||
|
|
|
||
|
|
- [audit-logging](../../../compliance/auditing/audit-logging/) - Log analysis
|
||
|
|
- [alerting-oncall](../../../devops/observability/alerting-oncall/) - Alert management
|