From e66627aee5871c91eb016a4e0178bda9713f0df5 Mon Sep 17 00:00:00 2001 From: quill Date: Sat, 31 Oct 2026 16:23:47 +0000 Subject: [PATCH] quill: add security incident report template --- .../security-incident-report-template.md | 157 ++++++++++++++++++ 1 file changed, 157 insertions(+) create mode 100644 wizard-work/quill/security-incident-report-template.md diff --git a/wizard-work/quill/security-incident-report-template.md b/wizard-work/quill/security-incident-report-template.md new file mode 100644 index 0000000..7a80942 --- /dev/null +++ b/wizard-work/quill/security-incident-report-template.md @@ -0,0 +1,157 @@ +# Security Incident Report Template +## Classification: Internal Use | Version: 1.0 | Owner: Security Team + +--- + +## 1. Incident Overview + +| Field | Value | +|---|---| +| **Incident ID** | [AUTO: SEC-YYYYMMDD-NNN] | +| **Title** | [Brief descriptive title] | +| **Severity** | P1 (Critical) / P2 (High) / P3 (Medium) / P4 (Low) | +| **Current Status** | Detected / Contained / Eradicated / Recovering / Closed | +| **Reported By** | [Name, Role, Contact] | +| **Reported At** | [ISO 8601 timestamp] | +| **Assigned To** | [Incident Handler / Team] | + +--- + +## 2. Executive Summary + +Write 2–4 sentences covering: +- What happened +- Systems/data affected +- Current containment state +- Business impact estimate + +[Placeholder — maximum 200 words] + +--- + +## 3. Timeline of Events + +| # | Timestamp (UTC) | Event | Source | Confidence | +|---|---|---|---|---| +| 1 | [YYYY-MM-DDTHH:MMZ] | [Observed or inferred event] | [Log source, alert ID] | Confirmed / Inferred | +| 2 | [YYYY-MM-DDTHH:MMZ] | [Observed or inferred event] | [Log source, alert ID] | Confirmed / Inferred | +| 3 | [YYYY-MM-DDTHH:MMZ] | [Observed or inferred event] | [Log source, alert ID] | Confirmed / Inferred | +| 4 | [YYYY-MM-DDTHH:MMZ] | [Observed or inferred event] | [Log source, alert ID] | Confirmed / Inferred | +| 5 | [YYYY-MM-DDTHH:MMZ] | [Observed or inferred event] | [Log source, alert ID] | Confirmed / Inferred | +| 6 | ... | ... | ... | ... | + +Minimum rows: 5. Include at minimum: initial detection, first anomaly indicator, containment action, communication to stakeholders, current status change. + +--- + +## 4. Affected Assets + +| Asset Type | Identifier | Owner | Impact | Current State | +|---|---|---|---|---| +| Server | [hostname/IP] | [Team] | Compromised / Degraded / Unaffected | Isolated / Active / Quarantined | +| Service | [name] | [Team] | Data exposure / Auth bypass / DoS | Patched / Blocked / Restored | +| Data | [dataset/table/file] | [Owner] | PII exposed / Integrity loss | Encrypted / Wiped / Intact | +| Account | [user/service acct] | [Owner] | Privilege escalation | Disabled / Reset / Monitored | + +Minimum rows: 3 distinct asset types. + +--- + +## 5. Root Cause Analysis + +### 5.1 Immediate Cause +[Technical description of what directly enabled the incident] + +### 5.2 Contributing Factors +1. [Missing control, misconfiguration, unpatched vulnerability, human error] +2. ... + +### 5.3 Evidence Summary +| Evidence Item | Location | Date/Time | Integrity Check | +|---|---|---|---| +| [Log file, memory dump, network capture, config snapshot] | [path or ID] | [ISO 8601] | SHA256: [hash or N/A] | +| [Log file, memory dump, network capture, config snapshot] | [path or ID] | [ISO 8601] | SHA256: [hash or N/A] | +| [Log file, memory dump, network capture, config snapshot] | [path or ID] | [ISO 8601] | SHA256: [hash or N/A] | + +Minimum items: 3. + +--- + +## 6. Impact Assessment + +### 6.1 Confidentiality +- Data types exposed: [PII / PHI / Financial / Credentials / Source code / None] +- Estimated records affected: [N] +- Notification required: [Yes / No / Pending legal review] + +### 6.2 Integrity +- Data modified: [Yes / No / Partially] +- Systems altered: [List or None] + +### 6.3 Availability +- Service downtime: [Start — End] = [Duration] +- Degraded performance window: [Start — End] = [Duration] + +### 6.4 Financial Estimate +| Category | Estimate | Notes | +|---|---|---| +| Direct labor (response hours) | $[N] | [N] responders x [N] hours x $[rate] | +| Lost revenue / SLA penalty | $[N] | [Basis] | +| Regulatory fine exposure | $[N] | [Jurisdiction, max exposure] | +| Reputational / intangible | TBD | — | + +--- + +## 7. Containment Actions + +| # | Action | Performed By | Timestamp (UTC) | Verification | +|---|---|---|---|---| +| 1 | [Isolated host, revoked token, blocked IP, applied WAF rule] | [Name] | [ISO 8601] | [Confirmed by ...] | +| 2 | [Isolated host, revoked token, blocked IP, applied WAF rule] | [Name] | [ISO 8601] | [Confirmed by ...] | +| 3 | [Isolated host, revoked token, blocked IP, applied WAF rule] | [Name] | [ISO 8601] | [Confirmed by ...] | +| 4 | ... | ... | ... | ... | + +Minimum rows: 3. + +--- + +## 8. Remediation Steps + +| # | Step | Owner | ETA | Status | Verification Method | +|---|---|---|---|---|---| +| 1 | [Patch CVE-XXXX-XXXX, rotate secrets, rebuild from clean image] | [Name] | [YYYY-MM-DD] | Open / In Progress / Done | [Scan result, test, diff] | +| 2 | ... | ... | ... | ... | ... | + +--- + +## 9. Lessons Learned + +### What Went Well +1. [Detection speed, team coordination, tool effectiveness] + +### What Could Improve +1. [Monitoring gaps, alert tuning, runbook gaps, communication delays] + +### Action Items +| # | Action | Owner | Due Date | Priority | +|---|---|---|---|---| +| 1 | [Add detection rule, update runbook, schedule drill] | [Name] | [YYYY-MM-DD] | High / Medium / Low | +| 2 | ... | ... | ... | ... | + +Minimum rows: 2. + +--- + +## 10. Sign-Off + +| Role | Name | Signature / Auth Method | Date | +|---|---|---|---| +| Incident Commander | | | | +| Security Lead | | | | +| Engineering Lead | | | | +| Legal / Compliance | | | | +| Executive Sponsor | | | | + +--- + +*Template maintained by the Security team. Update version when sections are added or removed. Do not distribute externally without Legal review.*