.

security/operations/incident-response/references/incident-playbook.md

@@ -0,0 +1,147 @@
+# Incident Response Playbook
+
+## Incident Severity Levels
+
+| Level | Name | Description | Response Time | Example |
+|-------|------|-------------|---------------|---------|
+| SEV1 | Critical | Active breach, data exfiltration | Immediate | Ransomware, active attacker |
+| SEV2 | High | Confirmed compromise, contained | 1 hour | Malware, credential theft |
+| SEV3 | Medium | Suspicious activity, potential threat | 4 hours | Phishing success, anomaly |
+| SEV4 | Low | Minor security event | 24 hours | Policy violation |
+
+## Response Phases
+
+### 1. Detection & Triage (0-15 minutes)
+
+```
+□ Confirm the incident is real (not false positive)
+□ Assess initial scope and severity
+□ Assign Incident Commander
+□ Open incident channel (#incident-YYYY-MM-DD)
+□ Start incident timeline documentation
+```
+
+**Key Questions:**
+- What systems are affected?
+- Is the threat active?
+- What data may be compromised?
+- Is it contained or spreading?
+
+### 2. Containment (15-60 minutes)
+
+**Short-term Containment:**
+```
+□ Isolate affected systems (network/firewall)
+□ Block malicious IPs/domains
+□ Disable compromised accounts
+□ Preserve evidence before changes
+```
+
+**Commands:**
+```bash
+# Network isolation
+iptables -I INPUT -s <malicious-ip> -j DROP
+iptables -I OUTPUT -d <malicious-ip> -j DROP
+
+# Account disable
+usermod -L <username>
+passwd -l <username>
+
+# Service isolation
+systemctl stop <compromised-service>
+```
+
+### 3. Investigation (1-4 hours)
+
+```
+□ Collect evidence (logs, memory, disk)
+□ Identify attack vector
+□ Determine scope of compromise
+□ Document findings in timeline
+```
+
+**Log Sources:**
+- Authentication: /var/log/auth.log, CloudTrail
+- Application: Application logs, APM
+- Network: Firewall logs, VPC Flow Logs
+- System: syslog, journald
+
+### 4. Eradication (1-24 hours)
+
+```
+□ Remove malware/backdoors
+□ Patch vulnerabilities
+□ Reset compromised credentials
+□ Update security controls
+□ Verify complete removal
+```
+
+### 5. Recovery (1-48 hours)
+
+```
+□ Restore systems from clean backups
+□ Validate system integrity
+□ Monitor for re-infection
+□ Gradually restore services
+□ Communicate status updates
+```
+
+### 6. Post-Incident (1-2 weeks)
+
+```
+□ Conduct blameless post-mortem
+□ Document lessons learned
+□ Create action items
+□ Update runbooks and detection
+□ Report to stakeholders
+□ File regulatory notifications (if required)
+```
+
+## Communication Templates
+
+### Internal Notification
+```
+SECURITY INCIDENT - [SEV LEVEL]
+
+Status: Active/Contained/Resolved
+Incident Commander: [Name]
+Channel: #incident-YYYY-MM-DD
+
+Summary: [Brief description]
+
+Impact:
+- Systems: [List]
+- Data: [Type if applicable]
+- Users: [Count/scope]
+
+Current Actions:
+- [Action 1]
+- [Action 2]
+
+Next Update: [Time]
+```
+
+### External Notification (if required)
+```
+Subject: Security Incident Notification
+
+We are writing to inform you of a security incident 
+that occurred on [DATE].
+
+What Happened: [Description]
+Data Involved: [Types]
+Actions Taken: [Response measures]
+What You Can Do: [Recommendations]
+Contact: [Security team contact]
+```
+
+## Escalation Contacts
+
+| Role | Primary | Secondary |
+|------|---------|-----------|
+| Incident Commander | [Name] | [Name] |
+| Security Lead | [Name] | [Name] |
+| Engineering Lead | [Name] | [Name] |
+| Legal/Compliance | [Name] | [Name] |
+| Communications | [Name] | [Name] |
+| Executive Sponsor | [Name] | [Name] |