DevOps-Security-Agent-Skills/security/operations/incident-response/references/incident-playbook.md

Incident Response Playbook

Incident Severity Levels

Level	Name	Description	Response Time	Example
SEV1	Critical	Active breach, data exfiltration	Immediate	Ransomware, active attacker
SEV2	High	Confirmed compromise, contained	1 hour	Malware, credential theft
SEV3	Medium	Suspicious activity, potential threat	4 hours	Phishing success, anomaly
SEV4	Low	Minor security event	24 hours	Policy violation

Response Phases

1. Detection & Triage (0-15 minutes)

□ Confirm the incident is real (not false positive)
□ Assess initial scope and severity
□ Assign Incident Commander
□ Open incident channel (#incident-YYYY-MM-DD)
□ Start incident timeline documentation

Key Questions:

• What systems are affected?
• Is the threat active?
• What data may be compromised?
• Is it contained or spreading?

2. Containment (15-60 minutes)

Short-term Containment:

□ Isolate affected systems (network/firewall)
□ Block malicious IPs/domains
□ Disable compromised accounts
□ Preserve evidence before changes

Commands:

# Network isolation
iptables -I INPUT -s <malicious-ip> -j DROP
iptables -I OUTPUT -d <malicious-ip> -j DROP

# Account disable
usermod -L <username>
passwd -l <username>

# Service isolation
systemctl stop <compromised-service>

3. Investigation (1-4 hours)

□ Collect evidence (logs, memory, disk)
□ Identify attack vector
□ Determine scope of compromise
□ Document findings in timeline

Log Sources:

• Authentication: /var/log/auth.log, CloudTrail
• Application: Application logs, APM
• Network: Firewall logs, VPC Flow Logs
• System: syslog, journald

4. Eradication (1-24 hours)

□ Remove malware/backdoors
□ Patch vulnerabilities
□ Reset compromised credentials
□ Update security controls
□ Verify complete removal

5. Recovery (1-48 hours)

□ Restore systems from clean backups
□ Validate system integrity
□ Monitor for re-infection
□ Gradually restore services
□ Communicate status updates

6. Post-Incident (1-2 weeks)

□ Conduct blameless post-mortem
□ Document lessons learned
□ Create action items
□ Update runbooks and detection
□ Report to stakeholders
□ File regulatory notifications (if required)

Communication Templates

Internal Notification

SECURITY INCIDENT - [SEV LEVEL]

Status: Active/Contained/Resolved
Incident Commander: [Name]
Channel: #incident-YYYY-MM-DD

Summary: [Brief description]

Impact:
- Systems: [List]
- Data: [Type if applicable]
- Users: [Count/scope]

Current Actions:
- [Action 1]
- [Action 2]

Next Update: [Time]

External Notification (if required)

Subject: Security Incident Notification

We are writing to inform you of a security incident 
that occurred on [DATE].

What Happened: [Description]
Data Involved: [Types]
Actions Taken: [Response measures]
What You Can Do: [Recommendations]
Contact: [Security team contact]

Escalation Contacts

Role	Primary	Secondary
Incident Commander	[Name]	[Name]
Security Lead	[Name]	[Name]
Engineering Lead	[Name]	[Name]
Legal/Compliance	[Name]	[Name]
Communications	[Name]	[Name]
Executive Sponsor	[Name]	[Name]