.

security/operations/incident-response/assets/incident-template.md

@@ -0,0 +1,155 @@
+# Incident Report: [INCIDENT-ID]
+
+## Executive Summary
+
+| Field | Value |
+|-------|-------|
+| **Incident ID** | INC-YYYY-MMDD-XXX |
+| **Status** | Open / Contained / Resolved |
+| **Severity** | SEV1 / SEV2 / SEV3 / SEV4 |
+| **Incident Commander** | [Name] |
+| **Detection Time** | YYYY-MM-DD HH:MM UTC |
+| **Resolution Time** | YYYY-MM-DD HH:MM UTC |
+| **Duration** | X hours Y minutes |
+
+**Summary:** [1-2 sentence description of the incident]
+
+---
+
+## Timeline
+
+| Time (UTC) | Event |
+|------------|-------|
+| YYYY-MM-DD HH:MM | [Event description] |
+| YYYY-MM-DD HH:MM | [Event description] |
+| YYYY-MM-DD HH:MM | [Event description] |
+
+---
+
+## Impact Assessment
+
+### Systems Affected
+- [ ] System 1 - [Impact description]
+- [ ] System 2 - [Impact description]
+
+### Data Affected
+- [ ] Type of data
+- [ ] Volume
+- [ ] Sensitivity classification
+
+### Users Affected
+- Number of users: [X]
+- User groups: [Groups]
+
+### Business Impact
+- [ ] Service downtime: [Duration]
+- [ ] Financial impact: [Estimate]
+- [ ] Reputation impact: [Assessment]
+
+---
+
+## Root Cause Analysis
+
+### Attack Vector
+[Description of how the incident occurred]
+
+### Contributing Factors
+1. [Factor 1]
+2. [Factor 2]
+3. [Factor 3]
+
+### Root Cause
+[Description of the underlying cause]
+
+---
+
+## Indicators of Compromise (IOCs)
+
+### IP Addresses
+```
+X.X.X.X - [Description]
+```
+
+### Domains
+```
+malicious.domain.com - [Description]
+```
+
+### File Hashes
+```
+SHA256: [hash] - [Filename]
+```
+
+### Other IOCs
+[Any other relevant indicators]
+
+---
+
+## Response Actions
+
+### Containment
+- [x] Action 1
+- [x] Action 2
+- [ ] Action 3 (in progress)
+
+### Eradication
+- [ ] Action 1
+- [ ] Action 2
+
+### Recovery
+- [ ] Action 1
+- [ ] Action 2
+
+---
+
+## Lessons Learned
+
+### What Went Well
+1. [Item 1]
+2. [Item 2]
+
+### What Could Be Improved
+1. [Item 1]
+2. [Item 2]
+
+---
+
+## Action Items
+
+| ID | Action | Owner | Due Date | Status |
+|----|--------|-------|----------|--------|
+| 1 | [Action description] | [Name] | YYYY-MM-DD | Open |
+| 2 | [Action description] | [Name] | YYYY-MM-DD | Open |
+
+---
+
+## Notifications
+
+### Internal
+- [ ] Security Team
+- [ ] Engineering Team
+- [ ] Executive Team
+- [ ] Legal/Compliance
+
+### External
+- [ ] Affected customers
+- [ ] Regulatory bodies
+- [ ] Law enforcement
+
+---
+
+## Appendix
+
+### Evidence Files
+- [Link to evidence archive]
+- [Link to log exports]
+
+### Related Documents
+- [Link to runbook used]
+- [Link to previous incidents]
+
+---
+
+**Report Author:** [Name]  
+**Report Date:** YYYY-MM-DD  
+**Last Updated:** YYYY-MM-DD