Prerequisites

3. Evidence Collection Phase

Gather forensic data systematically:

System Evidence:

• Memory dumps from affected systems
• Disk images for forensic analysis
• Running process listings
• Network connection states
• Registry modifications (Windows)

Log Evidence:

• Authentication logs (successful/failed logins)
• Application logs with error patterns
• Network traffic logs (firewall, IDS/IPS)
• Database access logs
• Web server access/error logs

Network Evidence:

• Packet captures (PCAP files)
• DNS query logs
• Proxy server logs
• Network flow data (NetFlow)

4. Investigation and Analysis

Reconstruct the attack timeline:

• Identify initial access vector (how attackers got in)
• Map lateral movement within network
• Determine data exfiltration attempts
• Identify persistence mechanisms
• Assess privilege escalation methods
• Document indicators of compromise (IOCs)

5. Eradication Phase

Remove threat from environment:

• Remove malware and backdoors
• Close exploited vulnerabilities
• Reset compromised credentials
• Apply security patches
• Update firewall rules
• Verify threat elimination

6. Recovery and Restoration

Restore normal operations:

• Restore systems from clean backups
• Rebuild compromised systems from scratch
• Verify system integrity
• Monitor for reinfection attempts
• Gradually restore services
• Validate business operations

7. Post-Incident Documentation

Create comprehensive incident report:

• Executive summary
• Detailed timeline
• Root cause analysis
• Lessons learned
• Remediation recommendations
• Cost impact assessment

Output

The skill produces:

Primary Output: Incident response playbook saved to {baseDir}/incidents/incident-YYYYMMDD-HHMM.md

Playbook Structure:

# Security Incident Response - [Incident Type]
Date: YYYY-MM-DD HH:MM
Severity: CRITICAL
Status: Contained

## Executive Summary
- Incident type: Ransomware attack
- Detection time: 2024-01-15 08:30 UTC
- Affected systems: 15 servers, 200 workstations
- Business impact: Production halted
- Current status: Contained, recovery in progress

## Timeline of Events