quill: add security incident report template

2026-10-31 16:23:47 +00:00
1 parent 344c132b12
commit e66627aee5
@@ -0,0 +1,157 @@
+# Security Incident Report Template
+## Classification: Internal Use | Version: 1.0 | Owner: Security Team
+
+---
+
+## 1. Incident Overview
+
+| Field | Value |
+|---|---|
+| **Incident ID** | [AUTO: SEC-YYYYMMDD-NNN] |
+| **Title** | [Brief descriptive title] |
+| **Severity** | P1 (Critical) / P2 (High) / P3 (Medium) / P4 (Low) |
+| **Current Status** | Detected / Contained / Eradicated / Recovering / Closed |
+| **Reported By** | [Name, Role, Contact] |
+| **Reported At** | [ISO 8601 timestamp] |
+| **Assigned To** | [Incident Handler / Team] |
+
+---
+
+## 2. Executive Summary
+
+Write 2–4 sentences covering:
+- What happened
+- Systems/data affected
+- Current containment state
+- Business impact estimate
+
+[Placeholder — maximum 200 words]
+
+---
+
+## 3. Timeline of Events
+
+| # | Timestamp (UTC) | Event | Source | Confidence |
+|---|---|---|---|---|
+| 1 | [YYYY-MM-DDTHH:MMZ] | [Observed or inferred event] | [Log source, alert ID] | Confirmed / Inferred |
+| 2 | [YYYY-MM-DDTHH:MMZ] | [Observed or inferred event] | [Log source, alert ID] | Confirmed / Inferred |
+| 3 | [YYYY-MM-DDTHH:MMZ] | [Observed or inferred event] | [Log source, alert ID] | Confirmed / Inferred |
+| 4 | [YYYY-MM-DDTHH:MMZ] | [Observed or inferred event] | [Log source, alert ID] | Confirmed / Inferred |
+| 5 | [YYYY-MM-DDTHH:MMZ] | [Observed or inferred event] | [Log source, alert ID] | Confirmed / Inferred |
+| 6 | ... | ... | ... | ... |
+
+Minimum rows: 5. Include at minimum: initial detection, first anomaly indicator, containment action, communication to stakeholders, current status change.
+
+---
+
+## 4. Affected Assets
+
+| Asset Type | Identifier | Owner | Impact | Current State |
+|---|---|---|---|---|
+| Server | [hostname/IP] | [Team] | Compromised / Degraded / Unaffected | Isolated / Active / Quarantined |
+| Service | [name] | [Team] | Data exposure / Auth bypass / DoS | Patched / Blocked / Restored |
+| Data | [dataset/table/file] | [Owner] | PII exposed / Integrity loss | Encrypted / Wiped / Intact |
+| Account | [user/service acct] | [Owner] | Privilege escalation | Disabled / Reset / Monitored |
+
+Minimum rows: 3 distinct asset types.
+
+---
+
+## 5. Root Cause Analysis
+
+### 5.1 Immediate Cause
+[Technical description of what directly enabled the incident]
+
+### 5.2 Contributing Factors
+1. [Missing control, misconfiguration, unpatched vulnerability, human error]
+2. ...
+
+### 5.3 Evidence Summary
+| Evidence Item | Location | Date/Time | Integrity Check |
+|---|---|---|---|
+| [Log file, memory dump, network capture, config snapshot] | [path or ID] | [ISO 8601] | SHA256: [hash or N/A] |
+| [Log file, memory dump, network capture, config snapshot] | [path or ID] | [ISO 8601] | SHA256: [hash or N/A] |
+| [Log file, memory dump, network capture, config snapshot] | [path or ID] | [ISO 8601] | SHA256: [hash or N/A] |
+
+Minimum items: 3.
+
+---
+
+## 6. Impact Assessment
+
+### 6.1 Confidentiality
+- Data types exposed: [PII / PHI / Financial / Credentials / Source code / None]
+- Estimated records affected: [N]
+- Notification required: [Yes / No / Pending legal review]
+
+### 6.2 Integrity
+- Data modified: [Yes / No / Partially]
+- Systems altered: [List or None]
+
+### 6.3 Availability
+- Service downtime: [Start — End] = [Duration]
+- Degraded performance window: [Start — End] = [Duration]
+
+### 6.4 Financial Estimate
+| Category | Estimate | Notes |
+|---|---|---|
+| Direct labor (response hours) | $[N] | [N] responders x [N] hours x $[rate] |
+| Lost revenue / SLA penalty | $[N] | [Basis] |
+| Regulatory fine exposure | $[N] | [Jurisdiction, max exposure] |
+| Reputational / intangible | TBD | — |
+
+---
+
+## 7. Containment Actions
+
+| # | Action | Performed By | Timestamp (UTC) | Verification |
+|---|---|---|---|---|
+| 1 | [Isolated host, revoked token, blocked IP, applied WAF rule] | [Name] | [ISO 8601] | [Confirmed by ...] |
+| 2 | [Isolated host, revoked token, blocked IP, applied WAF rule] | [Name] | [ISO 8601] | [Confirmed by ...] |
+| 3 | [Isolated host, revoked token, blocked IP, applied WAF rule] | [Name] | [ISO 8601] | [Confirmed by ...] |
+| 4 | ... | ... | ... | ... |
+
+Minimum rows: 3.
+
+---
+
+## 8. Remediation Steps
+
+| # | Step | Owner | ETA | Status | Verification Method |
+|---|---|---|---|---|---|
+| 1 | [Patch CVE-XXXX-XXXX, rotate secrets, rebuild from clean image] | [Name] | [YYYY-MM-DD] | Open / In Progress / Done | [Scan result, test, diff] |
+| 2 | ... | ... | ... | ... | ... |
+
+---
+
+## 9. Lessons Learned
+
+### What Went Well
+1. [Detection speed, team coordination, tool effectiveness]
+
+### What Could Improve
+1. [Monitoring gaps, alert tuning, runbook gaps, communication delays]
+
+### Action Items
+| # | Action | Owner | Due Date | Priority |
+|---|---|---|---|---|
+| 1 | [Add detection rule, update runbook, schedule drill] | [Name] | [YYYY-MM-DD] | High / Medium / Low |
+| 2 | ... | ... | ... | ... |
+
+Minimum rows: 2.
+
+---
+
+## 10. Sign-Off
+
+| Role | Name | Signature / Auth Method | Date |
+|---|---|---|---|
+| Incident Commander | | | |
+| Security Lead | | | |
+| Engineering Lead | | | |
+| Legal / Compliance | | | |
+| Executive Sponsor | | | |
+
+---
+
+*Template maintained by the Security team. Update version when sections are added or removed. Do not distribute externally without Legal review.*