security-incident-reporting

SKILL.md

Comprehensive framework for documenting and analyzing security incidents, drawing from NIST SP 800-61 and SANS methodologies.

| Phase | NIST | SANS | Documentation Focus |

| 1 | Preparation | Preparation | Runbooks, contacts, tools | | 2 | Detection & Analysis | Identification | Initial detection, triage | | 3 | Containment | Containment | Isolation actions, timeline | | 4 | Eradication | Eradication | Root cause removal | | 5 | Recovery | Recovery | Service restoration |

Modèles de rapport d'incident de sécurité tirés du NIST/SANS. Post-mortem DDoS, corrélation CVE, documentation chronologique et analyse irréprochable des causes profondes. Source : dirnbauer/webconsulting-skills.

Voir l'original