Authors: Incident Commander - Morpheus (morpheus@therealworld.net) | Dan Kaminsky (dkaminsky@company.net)
Version: 1.5
Created Date: D/M/Y or M/D/Y
Last Updated: D/M/Y or M/D/Y
Incident Level: Sev 2
Tickets: e.g. INCIDENT-31337
Slack Channels: #incident #incident31337-investigation #ops
Working folder: <URL to folder containing relevant incident material>
One paragraph describing the issue which can be understood by an executive.
Example "The mobile application started acting strangely by showing system error messages to the user. This was a result if a bad code change which has since been reverted and addressed the issue. The result of these error messages disclosed internal system names and system paths from the mobile api login endpoints."
Include all relevant conclusions, should include
- Behavior observed
- Investigation performed
- Determinations
- Impacts
- Outcome/s
| Priority | Status | Action name | Action owner | Estimated resolution | Link to Jira ticket |
|---|---|---|---|---|---|
| P1 | Completed | File behavior as a defect within appropriate engineering team | John Mcafee | 4/20/24 | EPIC-1337 |
| P1 | Planned | Schedule incident retrospective | Morpheus | 4/22/24 | INCIDENT-31338 |
| Priority | Question | Notes | Answer |
|---|---|---|---|
| P0 | Has customer data been impacted? If so what is the scope? | ||
| P0 | Has attacker/s compromised an asset? If so, what is being done to determine the full scope of a potential breach? |
| Name | Role | Involvement |
|---|---|---|
| Johnny Mnemonic | Mobile app developer | Discovered issue |
| Morpheus | Security Incident Commander | Project managed incident |
| Grace Hopper | Director of Mobile | Mobile, Product engineering leadership |
| John Mcafee | Engineering Manager | Mobile, Eng team |
| Dan Kaminsky | Basically Neo | Security oncall that performed all forensic and technical analysis. |
Date - Time + Timezone + Description of event
4/20/24 - 9:01AM PST - First indication of problem discovered by 'Johnny Mnemonic"
4/20/24 - 9:10AM PST - Security team/IT notified
..... More entries ....
4/21/24 - 12:25pm PST - Incident retrospective scheduled
4/21/24 - 1:00am PST - Incident resolved
- <Google drive folder URL >
- <Link to incident raw notes or working folder>
Template version 1.5 copied from Sectemplates.com 2025