ir-playbook

Incident severity is classified by assessing functional impact, information impact, and recoverability inputs based on NIST SP 800-61 Rev 2 guidelines. This structured workflow evaluates these factors to determine a standardized severity level and incident category for active security alerts.

Containment strategy for destructive malware is determined using a decision tree that balances operational urgency against business impact. The workflow provides specific handling guidance for wiper and destructive threats to ensure rapid isolation while minimizing operational disruption.

Documenting incident notifications and escalation criteria requires a standardized operational report containing executive summaries, timelines, and stakeholder notification logs. This approach ensures all evidence preservation and escalation decisions are recorded in an auditable format aligned with SANS guidelines.

Yes, this incident response workflow applies when an alert or user report indicates an active incident. It processes the provided incident details to classify the event, recommend containment, and generate a structured response plan without executing attacker-provided instructions.

Incident response reporting generates output that includes standardized sections for IOCs, containment actions, and post-incident review (PIR) handoff. The report schema ensures all critical operational data and timelines are captured consistently for downstream analysis.

Automated containment decision trees provide structured guidance but require accurate functional impact and recoverability inputs to function effectively. The workflow does not execute attacker-provided instructions, limiting its response actions to documented eradication and recovery recommendations.