> For the complete documentation index, see [llms.txt](https://moharat.gitbook.io/cylabs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://moharat.gitbook.io/cylabs/operational-security/incident-response.md).

# Incident Response

Synopsis of the Incident :

Date and Time  (Timeline)

Infected Assets :

Affected Users : \[ asset name : username]

Containment Status :

Remediation Status :

Artifact Collection Status :

* End point
* Event logs
* Network logs
* System memory
* Registry changes
* Did we collected Memory using Forensics tool
* Did we collected asset

 

Incident impact analysis:

* Is data compromised
* Is credentials compromised
* Is system in accessible
* Is data exfiltrated
* Is network ransomware

 

Indicator of attack and compromise:

* Initial payload delivery
* Payload execution
* Information gathering
* C2 communication
* Lateral movement
* IOC
* IOA
* complete TTP's
* Use MITRE framework
* * Reconnaissance
  * Resource Development
  * Initial Access
  * Execution
  * Persistence
  * Privilege Escalation
  * Defense Evasion
  * Credential Access
  * Discovery
  * Lateral Movement
  * Collection
  * Exfiltration
  * Impact

 

 

Analysis

* Hashes
* Timestamps
* Detections by AV
* Complete TTP's

 

 

References :

<https://github.com/mitre-attack/attack-stix-data>