mirror of
https://github.com/BagelHole/DevOps-Security-Agent-Skills.git
synced 2026-08-22 12:49:53 +02:00
148 lines
3.3 KiB
Markdown
148 lines
3.3 KiB
Markdown
# Incident Response Playbook
|
|
|
|
## Incident Severity Levels
|
|
|
|
| Level | Name | Description | Response Time | Example |
|
|
|-------|------|-------------|---------------|---------|
|
|
| SEV1 | Critical | Active breach, data exfiltration | Immediate | Ransomware, active attacker |
|
|
| SEV2 | High | Confirmed compromise, contained | 1 hour | Malware, credential theft |
|
|
| SEV3 | Medium | Suspicious activity, potential threat | 4 hours | Phishing success, anomaly |
|
|
| SEV4 | Low | Minor security event | 24 hours | Policy violation |
|
|
|
|
## Response Phases
|
|
|
|
### 1. Detection & Triage (0-15 minutes)
|
|
|
|
```
|
|
□ Confirm the incident is real (not false positive)
|
|
□ Assess initial scope and severity
|
|
□ Assign Incident Commander
|
|
□ Open incident channel (#incident-YYYY-MM-DD)
|
|
□ Start incident timeline documentation
|
|
```
|
|
|
|
**Key Questions:**
|
|
- What systems are affected?
|
|
- Is the threat active?
|
|
- What data may be compromised?
|
|
- Is it contained or spreading?
|
|
|
|
### 2. Containment (15-60 minutes)
|
|
|
|
**Short-term Containment:**
|
|
```
|
|
□ Isolate affected systems (network/firewall)
|
|
□ Block malicious IPs/domains
|
|
□ Disable compromised accounts
|
|
□ Preserve evidence before changes
|
|
```
|
|
|
|
**Commands:**
|
|
```bash
|
|
# Network isolation
|
|
iptables -I INPUT -s <malicious-ip> -j DROP
|
|
iptables -I OUTPUT -d <malicious-ip> -j DROP
|
|
|
|
# Account disable
|
|
usermod -L <username>
|
|
passwd -l <username>
|
|
|
|
# Service isolation
|
|
systemctl stop <compromised-service>
|
|
```
|
|
|
|
### 3. Investigation (1-4 hours)
|
|
|
|
```
|
|
□ Collect evidence (logs, memory, disk)
|
|
□ Identify attack vector
|
|
□ Determine scope of compromise
|
|
□ Document findings in timeline
|
|
```
|
|
|
|
**Log Sources:**
|
|
- Authentication: /var/log/auth.log, CloudTrail
|
|
- Application: Application logs, APM
|
|
- Network: Firewall logs, VPC Flow Logs
|
|
- System: syslog, journald
|
|
|
|
### 4. Eradication (1-24 hours)
|
|
|
|
```
|
|
□ Remove malware/backdoors
|
|
□ Patch vulnerabilities
|
|
□ Reset compromised credentials
|
|
□ Update security controls
|
|
□ Verify complete removal
|
|
```
|
|
|
|
### 5. Recovery (1-48 hours)
|
|
|
|
```
|
|
□ Restore systems from clean backups
|
|
□ Validate system integrity
|
|
□ Monitor for re-infection
|
|
□ Gradually restore services
|
|
□ Communicate status updates
|
|
```
|
|
|
|
### 6. Post-Incident (1-2 weeks)
|
|
|
|
```
|
|
□ Conduct blameless post-mortem
|
|
□ Document lessons learned
|
|
□ Create action items
|
|
□ Update runbooks and detection
|
|
□ Report to stakeholders
|
|
□ File regulatory notifications (if required)
|
|
```
|
|
|
|
## Communication Templates
|
|
|
|
### Internal Notification
|
|
```
|
|
SECURITY INCIDENT - [SEV LEVEL]
|
|
|
|
Status: Active/Contained/Resolved
|
|
Incident Commander: [Name]
|
|
Channel: #incident-YYYY-MM-DD
|
|
|
|
Summary: [Brief description]
|
|
|
|
Impact:
|
|
- Systems: [List]
|
|
- Data: [Type if applicable]
|
|
- Users: [Count/scope]
|
|
|
|
Current Actions:
|
|
- [Action 1]
|
|
- [Action 2]
|
|
|
|
Next Update: [Time]
|
|
```
|
|
|
|
### External Notification (if required)
|
|
```
|
|
Subject: Security Incident Notification
|
|
|
|
We are writing to inform you of a security incident
|
|
that occurred on [DATE].
|
|
|
|
What Happened: [Description]
|
|
Data Involved: [Types]
|
|
Actions Taken: [Response measures]
|
|
What You Can Do: [Recommendations]
|
|
Contact: [Security team contact]
|
|
```
|
|
|
|
## Escalation Contacts
|
|
|
|
| Role | Primary | Secondary |
|
|
|------|---------|-----------|
|
|
| Incident Commander | [Name] | [Name] |
|
|
| Security Lead | [Name] | [Name] |
|
|
| Engineering Lead | [Name] | [Name] |
|
|
| Legal/Compliance | [Name] | [Name] |
|
|
| Communications | [Name] | [Name] |
|
|
| Executive Sponsor | [Name] | [Name] |
|