From 5f789397b8e1f1396f0af885ae3345ed9214c7a1 Mon Sep 17 00:00:00 2001 From: quill Date: Fri, 23 Oct 2026 09:22:17 +0000 Subject: [PATCH] quill: draft incident response runbook v0.1 --- .../quill/incident-response-runbook-draft.md | 41 +++++++++++++++++++ 1 file changed, 41 insertions(+) create mode 100644 wizard-work/quill/incident-response-runbook-draft.md diff --git a/wizard-work/quill/incident-response-runbook-draft.md b/wizard-work/quill/incident-response-runbook-draft.md new file mode 100644 index 0000000..ab04314 --- /dev/null +++ b/wizard-work/quill/incident-response-runbook-draft.md @@ -0,0 +1,41 @@ +# Incident Response Runbook — Draft v0.1 + +## Purpose +Provide a repeatable, evidence-based workflow for responding to security incidents so every handler knows the exact steps, who to page, and what to preserve. Reduces mean-time-to-detect (MTTD) and mean-time-to-respond (MTTR) by removing guesswork. + +## Scope +Applies to all production systems, managed endpoints, and cloud identities under `*.troupe.internal`. Excludes physical access controls and paper records. + +## Detection & Alerting +- **Alert sources**: PagerDuty, CloudWatch Alarms, Sigma rules, EDRE telemetry, user-reported phishing. +- **Triage criteria** (P1): data exfiltration path confirmed, customer PII exposure, or ransomware encryption on >1 host. +- **Initial evidence to collect**: alert payload, affected asset list, last-known-good state, CloudTrail event IDs for the past 6 hours. +- Tag every new detection as an **incident** only after triage confirms malicious intent. + +## Containment +- Isolate affected hosts at the network layer (`nftables` drop rule or AWS SG deny-all). +- Rotate all credentials for accounts that touched the affected asset during the incident window. +- Do NOT power off hosts before volatile memory acquisition; capture `LiME` or `osquery` process/memory tables first. +- Record containment actions in the incident ticket with timestamps for audit. + +## Eradication +- Verify removal: rootkit scan (`rkhunter --check --skip-keypress`), persistence audit (`crontab -l`, `systemctl list-units --type=service --state=failed`, `~/.ssh/authorized_keys` diffs). +- Re-image from known-good templates; do not patch in place. +- Revoke every API key, OAuth token, and SSH key created or used in the incident window. +- Confirm eradication with a second handler before closing the incident. + +## Recovery +- Restore from snapshots taken before the first indicator of compromise (IOC). +- Validate integrity: `sha256sum` of critical binaries, checksum of config files against git HEAD. +- Enable enhanced monitoring on recovered assets for 72 hours: `auditd` syscall logging, `bpftrace` exec tracing. +- If the incident affected customer data, notify the DPO before resuming normal traffic. + +## Post-Incident Review +- Draft timeline within 24 hours using verified evidence only; mark speculative inferences with `[UNCONFIRMED]`. +- Document root cause, blast radius, and three concrete remediation actions with owners and deadlines. +- Update detection rules and this runbook within 48 hours. + +## Communication Templates +- **Internal #incidents**: timestamp, host(s), impact, current action, ETA. +- **Executive summary**: 3 bullets — what happened, what we did, what changes. +- **Customer notice (if required)**: exposure type, affected record count, remediation steps, contact.