mirror of
https://github.com/BagelHole/DevOps-Security-Agent-Skills.git
synced 2026-08-22 12:49:53 +02:00
156 lines
2.5 KiB
Markdown
156 lines
2.5 KiB
Markdown
# Incident Report: [INCIDENT-ID]
|
|
|
|
## Executive Summary
|
|
|
|
| Field | Value |
|
|
|-------|-------|
|
|
| **Incident ID** | INC-YYYY-MMDD-XXX |
|
|
| **Status** | Open / Contained / Resolved |
|
|
| **Severity** | SEV1 / SEV2 / SEV3 / SEV4 |
|
|
| **Incident Commander** | [Name] |
|
|
| **Detection Time** | YYYY-MM-DD HH:MM UTC |
|
|
| **Resolution Time** | YYYY-MM-DD HH:MM UTC |
|
|
| **Duration** | X hours Y minutes |
|
|
|
|
**Summary:** [1-2 sentence description of the incident]
|
|
|
|
---
|
|
|
|
## Timeline
|
|
|
|
| Time (UTC) | Event |
|
|
|------------|-------|
|
|
| YYYY-MM-DD HH:MM | [Event description] |
|
|
| YYYY-MM-DD HH:MM | [Event description] |
|
|
| YYYY-MM-DD HH:MM | [Event description] |
|
|
|
|
---
|
|
|
|
## Impact Assessment
|
|
|
|
### Systems Affected
|
|
- [ ] System 1 - [Impact description]
|
|
- [ ] System 2 - [Impact description]
|
|
|
|
### Data Affected
|
|
- [ ] Type of data
|
|
- [ ] Volume
|
|
- [ ] Sensitivity classification
|
|
|
|
### Users Affected
|
|
- Number of users: [X]
|
|
- User groups: [Groups]
|
|
|
|
### Business Impact
|
|
- [ ] Service downtime: [Duration]
|
|
- [ ] Financial impact: [Estimate]
|
|
- [ ] Reputation impact: [Assessment]
|
|
|
|
---
|
|
|
|
## Root Cause Analysis
|
|
|
|
### Attack Vector
|
|
[Description of how the incident occurred]
|
|
|
|
### Contributing Factors
|
|
1. [Factor 1]
|
|
2. [Factor 2]
|
|
3. [Factor 3]
|
|
|
|
### Root Cause
|
|
[Description of the underlying cause]
|
|
|
|
---
|
|
|
|
## Indicators of Compromise (IOCs)
|
|
|
|
### IP Addresses
|
|
```
|
|
X.X.X.X - [Description]
|
|
```
|
|
|
|
### Domains
|
|
```
|
|
malicious.domain.com - [Description]
|
|
```
|
|
|
|
### File Hashes
|
|
```
|
|
SHA256: [hash] - [Filename]
|
|
```
|
|
|
|
### Other IOCs
|
|
[Any other relevant indicators]
|
|
|
|
---
|
|
|
|
## Response Actions
|
|
|
|
### Containment
|
|
- [x] Action 1
|
|
- [x] Action 2
|
|
- [ ] Action 3 (in progress)
|
|
|
|
### Eradication
|
|
- [ ] Action 1
|
|
- [ ] Action 2
|
|
|
|
### Recovery
|
|
- [ ] Action 1
|
|
- [ ] Action 2
|
|
|
|
---
|
|
|
|
## Lessons Learned
|
|
|
|
### What Went Well
|
|
1. [Item 1]
|
|
2. [Item 2]
|
|
|
|
### What Could Be Improved
|
|
1. [Item 1]
|
|
2. [Item 2]
|
|
|
|
---
|
|
|
|
## Action Items
|
|
|
|
| ID | Action | Owner | Due Date | Status |
|
|
|----|--------|-------|----------|--------|
|
|
| 1 | [Action description] | [Name] | YYYY-MM-DD | Open |
|
|
| 2 | [Action description] | [Name] | YYYY-MM-DD | Open |
|
|
|
|
---
|
|
|
|
## Notifications
|
|
|
|
### Internal
|
|
- [ ] Security Team
|
|
- [ ] Engineering Team
|
|
- [ ] Executive Team
|
|
- [ ] Legal/Compliance
|
|
|
|
### External
|
|
- [ ] Affected customers
|
|
- [ ] Regulatory bodies
|
|
- [ ] Law enforcement
|
|
|
|
---
|
|
|
|
## Appendix
|
|
|
|
### Evidence Files
|
|
- [Link to evidence archive]
|
|
- [Link to log exports]
|
|
|
|
### Related Documents
|
|
- [Link to runbook used]
|
|
- [Link to previous incidents]
|
|
|
|
---
|
|
|
|
**Report Author:** [Name]
|
|
**Report Date:** YYYY-MM-DD
|
|
**Last Updated:** YYYY-MM-DD
|