That this project will be created by the SOC/Incident Response Community
- Develop a Catalog of Incident Response Playbook for every MITRE Technique (that possible, to make one for).
- Develop a Catalog of Incident Response Playbook for uncommon incidents.
- Develop a Catalog of Exercise Scenarios that can be used for training purposes.
- Develop a Catalog of tools used for Incident Response [Plus Reviews for the different tools]
- Develop a Catalog of Incident Response Automations
- Develop a Catalog of Checklists (For Before, During, After Incidents)
- Develop a Catalog of Roles that a organization can use, to build their own program.
-
-
For every pull request submitted a issue must also be created.
-
This project will use a modified Incident Response Process of mixing SANS Incident Response Process and NIST Incident Response Process.
NOTE: The common "preparation" phase will not be part of this Incident Response Process, but on each playbook will include a
(P) Preparationat the beginning of each playbook.
More than one phase can be running in parallel.
- Investigate
- Remediate (contain, eradicate)
- Communicate
- Recover
- Lessons Learned
If you have any changes that you think would be good for this incident response process please create a issue description what you want to change to this incident response process.
- Companies Incident Response Process (Example of how different companies Incident Response Process)
- Add EVTX Examples for each Playbook (If Possible)
- Examples of Incident Response Automations
- SOAR Automation Examples
- Swimlane
- SOAR Automation Examples
- SIEM Case Examples
- Elastic SIEM
- Splunk
- Exabeam
- Endpoint Security Examples
- SentinelOne
Just felt like there was something missing for Incident Response and a centrally place for playbooks, SIEM Processes, Forensics and other processes around Incident Response.