quill: add security incident report template
This commit is contained in:
quill committed
1 parent
344c132b12
commit
e66627aee5
1 file changed
+157
@@ -0,0 +1,157 @@
|
|||||||
|
# Security Incident Report Template
|
||||||
|
## Classification: Internal Use | Version: 1.0 | Owner: Security Team
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## 1. Incident Overview
|
||||||
|
|
||||||
|
| Field | Value |
|
||||||
|
|---|---|
|
||||||
|
| **Incident ID** | [AUTO: SEC-YYYYMMDD-NNN] |
|
||||||
|
| **Title** | [Brief descriptive title] |
|
||||||
|
| **Severity** | P1 (Critical) / P2 (High) / P3 (Medium) / P4 (Low) |
|
||||||
|
| **Current Status** | Detected / Contained / Eradicated / Recovering / Closed |
|
||||||
|
| **Reported By** | [Name, Role, Contact] |
|
||||||
|
| **Reported At** | [ISO 8601 timestamp] |
|
||||||
|
| **Assigned To** | [Incident Handler / Team] |
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## 2. Executive Summary
|
||||||
|
|
||||||
|
Write 2–4 sentences covering:
|
||||||
|
- What happened
|
||||||
|
- Systems/data affected
|
||||||
|
- Current containment state
|
||||||
|
- Business impact estimate
|
||||||
|
|
||||||
|
[Placeholder — maximum 200 words]
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## 3. Timeline of Events
|
||||||
|
|
||||||
|
| # | Timestamp (UTC) | Event | Source | Confidence |
|
||||||
|
|---|---|---|---|---|
|
||||||
|
| 1 | [YYYY-MM-DDTHH:MMZ] | [Observed or inferred event] | [Log source, alert ID] | Confirmed / Inferred |
|
||||||
|
| 2 | [YYYY-MM-DDTHH:MMZ] | [Observed or inferred event] | [Log source, alert ID] | Confirmed / Inferred |
|
||||||
|
| 3 | [YYYY-MM-DDTHH:MMZ] | [Observed or inferred event] | [Log source, alert ID] | Confirmed / Inferred |
|
||||||
|
| 4 | [YYYY-MM-DDTHH:MMZ] | [Observed or inferred event] | [Log source, alert ID] | Confirmed / Inferred |
|
||||||
|
| 5 | [YYYY-MM-DDTHH:MMZ] | [Observed or inferred event] | [Log source, alert ID] | Confirmed / Inferred |
|
||||||
|
| 6 | ... | ... | ... | ... |
|
||||||
|
|
||||||
|
Minimum rows: 5. Include at minimum: initial detection, first anomaly indicator, containment action, communication to stakeholders, current status change.
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## 4. Affected Assets
|
||||||
|
|
||||||
|
| Asset Type | Identifier | Owner | Impact | Current State |
|
||||||
|
|---|---|---|---|---|
|
||||||
|
| Server | [hostname/IP] | [Team] | Compromised / Degraded / Unaffected | Isolated / Active / Quarantined |
|
||||||
|
| Service | [name] | [Team] | Data exposure / Auth bypass / DoS | Patched / Blocked / Restored |
|
||||||
|
| Data | [dataset/table/file] | [Owner] | PII exposed / Integrity loss | Encrypted / Wiped / Intact |
|
||||||
|
| Account | [user/service acct] | [Owner] | Privilege escalation | Disabled / Reset / Monitored |
|
||||||
|
|
||||||
|
Minimum rows: 3 distinct asset types.
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## 5. Root Cause Analysis
|
||||||
|
|
||||||
|
### 5.1 Immediate Cause
|
||||||
|
[Technical description of what directly enabled the incident]
|
||||||
|
|
||||||
|
### 5.2 Contributing Factors
|
||||||
|
1. [Missing control, misconfiguration, unpatched vulnerability, human error]
|
||||||
|
2. ...
|
||||||
|
|
||||||
|
### 5.3 Evidence Summary
|
||||||
|
| Evidence Item | Location | Date/Time | Integrity Check |
|
||||||
|
|---|---|---|---|
|
||||||
|
| [Log file, memory dump, network capture, config snapshot] | [path or ID] | [ISO 8601] | SHA256: [hash or N/A] |
|
||||||
|
| [Log file, memory dump, network capture, config snapshot] | [path or ID] | [ISO 8601] | SHA256: [hash or N/A] |
|
||||||
|
| [Log file, memory dump, network capture, config snapshot] | [path or ID] | [ISO 8601] | SHA256: [hash or N/A] |
|
||||||
|
|
||||||
|
Minimum items: 3.
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## 6. Impact Assessment
|
||||||
|
|
||||||
|
### 6.1 Confidentiality
|
||||||
|
- Data types exposed: [PII / PHI / Financial / Credentials / Source code / None]
|
||||||
|
- Estimated records affected: [N]
|
||||||
|
- Notification required: [Yes / No / Pending legal review]
|
||||||
|
|
||||||
|
### 6.2 Integrity
|
||||||
|
- Data modified: [Yes / No / Partially]
|
||||||
|
- Systems altered: [List or None]
|
||||||
|
|
||||||
|
### 6.3 Availability
|
||||||
|
- Service downtime: [Start — End] = [Duration]
|
||||||
|
- Degraded performance window: [Start — End] = [Duration]
|
||||||
|
|
||||||
|
### 6.4 Financial Estimate
|
||||||
|
| Category | Estimate | Notes |
|
||||||
|
|---|---|---|
|
||||||
|
| Direct labor (response hours) | $[N] | [N] responders x [N] hours x $[rate] |
|
||||||
|
| Lost revenue / SLA penalty | $[N] | [Basis] |
|
||||||
|
| Regulatory fine exposure | $[N] | [Jurisdiction, max exposure] |
|
||||||
|
| Reputational / intangible | TBD | — |
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## 7. Containment Actions
|
||||||
|
|
||||||
|
| # | Action | Performed By | Timestamp (UTC) | Verification |
|
||||||
|
|---|---|---|---|---|
|
||||||
|
| 1 | [Isolated host, revoked token, blocked IP, applied WAF rule] | [Name] | [ISO 8601] | [Confirmed by ...] |
|
||||||
|
| 2 | [Isolated host, revoked token, blocked IP, applied WAF rule] | [Name] | [ISO 8601] | [Confirmed by ...] |
|
||||||
|
| 3 | [Isolated host, revoked token, blocked IP, applied WAF rule] | [Name] | [ISO 8601] | [Confirmed by ...] |
|
||||||
|
| 4 | ... | ... | ... | ... |
|
||||||
|
|
||||||
|
Minimum rows: 3.
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## 8. Remediation Steps
|
||||||
|
|
||||||
|
| # | Step | Owner | ETA | Status | Verification Method |
|
||||||
|
|---|---|---|---|---|---|
|
||||||
|
| 1 | [Patch CVE-XXXX-XXXX, rotate secrets, rebuild from clean image] | [Name] | [YYYY-MM-DD] | Open / In Progress / Done | [Scan result, test, diff] |
|
||||||
|
| 2 | ... | ... | ... | ... | ... |
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## 9. Lessons Learned
|
||||||
|
|
||||||
|
### What Went Well
|
||||||
|
1. [Detection speed, team coordination, tool effectiveness]
|
||||||
|
|
||||||
|
### What Could Improve
|
||||||
|
1. [Monitoring gaps, alert tuning, runbook gaps, communication delays]
|
||||||
|
|
||||||
|
### Action Items
|
||||||
|
| # | Action | Owner | Due Date | Priority |
|
||||||
|
|---|---|---|---|---|
|
||||||
|
| 1 | [Add detection rule, update runbook, schedule drill] | [Name] | [YYYY-MM-DD] | High / Medium / Low |
|
||||||
|
| 2 | ... | ... | ... | ... |
|
||||||
|
|
||||||
|
Minimum rows: 2.
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## 10. Sign-Off
|
||||||
|
|
||||||
|
| Role | Name | Signature / Auth Method | Date |
|
||||||
|
|---|---|---|---|
|
||||||
|
| Incident Commander | | | |
|
||||||
|
| Security Lead | | | |
|
||||||
|
| Engineering Lead | | | |
|
||||||
|
| Legal / Compliance | | | |
|
||||||
|
| Executive Sponsor | | | |
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
*Template maintained by the Security team. Update version when sections are added or removed. Do not distribute externally without Legal review.*
|
||||||
Reference in new issue
Block a user