DevOps-Security-Agent-Skills/security/operations/incident-response/assets/incident-template.md

Incident Report: [INCIDENT-ID]

Executive Summary

Field	Value
Incident ID	INC-YYYY-MMDD-XXX
Status	Open / Contained / Resolved
Severity	SEV1 / SEV2 / SEV3 / SEV4
Incident Commander	[Name]
Detection Time	YYYY-MM-DD HH:MM UTC
Resolution Time	YYYY-MM-DD HH:MM UTC
Duration	X hours Y minutes

Summary: [1-2 sentence description of the incident]

---

Timeline

Time (UTC)	Event
YYYY-MM-DD HH:MM	[Event description]
YYYY-MM-DD HH:MM	[Event description]
YYYY-MM-DD HH:MM	[Event description]

---

Impact Assessment

Systems Affected

• System 1 - [Impact description]
• System 2 - [Impact description]

Data Affected

• Type of data
• Volume
• Sensitivity classification

Users Affected

• Number of users: [X]
• User groups: [Groups]

Business Impact

• Service downtime: [Duration]
• Financial impact: [Estimate]
• Reputation impact: [Assessment]

---

Root Cause Analysis

Attack Vector

[Description of how the incident occurred]

Contributing Factors

1. [Factor 1]
2. [Factor 2]
3. [Factor 3]

Root Cause

[Description of the underlying cause]

---

Indicators of Compromise (IOCs)

IP Addresses

X.X.X.X - [Description]

Domains

malicious.domain.com - [Description]

File Hashes

SHA256: [hash] - [Filename]

Other IOCs

[Any other relevant indicators]

---

Response Actions

Containment

• Action 1
• Action 2
• Action 3 (in progress)

Eradication

• Action 1
• Action 2

Recovery

• Action 1
• Action 2

---

Lessons Learned

What Went Well

1. [Item 1]
2. [Item 2]

What Could Be Improved

1. [Item 1]
2. [Item 2]

---

Action Items

ID	Action	Owner	Due Date	Status
1	[Action description]	[Name]	YYYY-MM-DD	Open
2	[Action description]	[Name]	YYYY-MM-DD	Open

---

Notifications

Internal

• Security Team
• Engineering Team
• Executive Team
• Legal/Compliance

External

• Affected customers
• Regulatory bodies
• Law enforcement

---

Appendix

Evidence Files

• [Link to evidence archive]
• [Link to log exports]

Related Documents

• [Link to runbook used]
• [Link to previous incidents]

---

Report Author: [Name]
Report Date: YYYY-MM-DD
Last Updated: YYYY-MM-DD