# Incident Report: [INCIDENT-ID]

## Executive Summary

| Field | Value |
|-------|-------|
| **Incident ID** | INC-YYYY-MMDD-XXX |
| **Status** | Open / Contained / Resolved |
| **Severity** | SEV1 / SEV2 / SEV3 / SEV4 |
| **Incident Commander** | [Name] |
| **Detection Time** | YYYY-MM-DD HH:MM UTC |
| **Resolution Time** | YYYY-MM-DD HH:MM UTC |
| **Duration** | X hours Y minutes |

**Summary:** [1-2 sentence description of the incident]

---

## Timeline

| Time (UTC) | Event |
|------------|-------|
| YYYY-MM-DD HH:MM | [Event description] |
| YYYY-MM-DD HH:MM | [Event description] |
| YYYY-MM-DD HH:MM | [Event description] |

---

## Impact Assessment

### Systems Affected
- [ ] System 1 - [Impact description]
- [ ] System 2 - [Impact description]

### Data Affected
- [ ] Type of data
- [ ] Volume
- [ ] Sensitivity classification

### Users Affected
- Number of users: [X]
- User groups: [Groups]

### Business Impact
- [ ] Service downtime: [Duration]
- [ ] Financial impact: [Estimate]
- [ ] Reputation impact: [Assessment]

---

## Root Cause Analysis

### Attack Vector
[Description of how the incident occurred]

### Contributing Factors
1. [Factor 1]
2. [Factor 2]
3. [Factor 3]

### Root Cause
[Description of the underlying cause]

---

## Indicators of Compromise (IOCs)

### IP Addresses
```
X.X.X.X - [Description]
```

### Domains
```
malicious.domain.com - [Description]
```

### File Hashes
```
SHA256: [hash] - [Filename]
```

### Other IOCs
[Any other relevant indicators]

---

## Response Actions

### Containment
- [x] Action 1
- [x] Action 2
- [ ] Action 3 (in progress)

### Eradication
- [ ] Action 1
- [ ] Action 2

### Recovery
- [ ] Action 1
- [ ] Action 2

---

## Lessons Learned

### What Went Well
1. [Item 1]
2. [Item 2]

### What Could Be Improved
1. [Item 1]
2. [Item 2]

---

## Action Items

| ID | Action | Owner | Due Date | Status |
|----|--------|-------|----------|--------|
| 1 | [Action description] | [Name] | YYYY-MM-DD | Open |
| 2 | [Action description] | [Name] | YYYY-MM-DD | Open |

---

## Notifications

### Internal
- [ ] Security Team
- [ ] Engineering Team
- [ ] Executive Team
- [ ] Legal/Compliance

### External
- [ ] Affected customers
- [ ] Regulatory bodies
- [ ] Law enforcement

---

## Appendix

### Evidence Files
- [Link to evidence archive]
- [Link to log exports]

### Related Documents
- [Link to runbook used]
- [Link to previous incidents]

---

**Report Author:** [Name]  
**Report Date:** YYYY-MM-DD  
**Last Updated:** YYYY-MM-DD