Incident Triage — Security Incident Response
Guide rapid triage and initial response to security incidents. Follow NIST SP 800-61 methodology.
Cross-references: siem-detection for the rules that produced the alert this triage is responding to, disk-forensics for deeper disk and memory analysis once a host is contained, breach-patterns for the post-incident pattern extraction that hardens against recurrence, soc-operations for the operational layer above this skill (runbooks, escalation, handoff), security-comms for the stakeholder / customer notifications the response generates, privacy-engineering / hipaa-audit / pci-audit for the regulatory-clock determination when personal data, PHI, or cardholder data is involved, ai-risk-management for AI-specific incident classes (model failure, fairness drift, jailbreak exploitation in production).
Priorities (in order)
- Preserve human safety
- Contain the incident to prevent further damage
- Preserve evidence for investigation
- Identify root cause and scope
- Document everything
Step 1: Classification
Determine incident type:
- Malware: ransomware, trojan, worm, cryptominer
- Unauthorized access: compromised credentials, exploitation
- Data exfiltration: data theft, insider threat
- Denial of service
- Web compromise: defacement, skimming, backdoor
- Phishing / social engineering
Determine severity:
- Critical: active data exfiltration, ransomware spreading, critical system compromise
- High: confirmed compromise, malware detected, unauthorized access
- Medium: suspicious activity, potential indicators, failed attacks
- Low: policy violation, reconnaissance detected, likely false positive
Step 2: Initial Containment
Based on type and severity:
- Network: block suspicious IPs/domains at firewall
- Host: isolate affected system (network disconnect, NOT power off — volatile memory is evidence)
- Account: disable compromised accounts, force password resets
- Application: disable affected service if safe to do so
Critical: Do NOT power off systems. Volatile memory contains evidence.
Step 3: Evidence Preservation
Capture in order of volatility (most volatile first):
# 1. Running processes
ps auxf # Linux
tasklist /v # Windows
# 2. Network connections
ss -tupn # Linux
netstat -anob # Windows
# 3. Logged-in users
who -a # Linux
query user # Windows
# 4. Open files
lsof -nP # Linux
# 5. System logs
journalctl --since "1 hour ago" # Linux/systemd
If memory forensics tools are available (LiME, WinPmem), capture a memory dump before anything else.
Step 4: Initial Analysis
For each suspicious indicator, document:
- What: describe the artifact
- When: timestamps in UTC
- Where: affected system(s)
- How: how it was detected
Common analysis:
- Process tree: look for unusual process names, paths, or parent-child relationships
- Network indicators: unusual outbound connections, DNS queries to suspicious domains, beaconing patterns (regular intervals)
- File indicators: recently modified files in unusual locations, hidden files, new executables
- Log analysis: authentication failures, privilege escalation, service changes, cleared logs
- Persistence: crontab, systemd units, registry Run keys, scheduled tasks, startup items
Step 5: IOC Extraction
Extract and document all indicators of compromise:
| Type |
Examples |
| IP addresses |
Source and destination IPs |
| Domains |
C2 domains, phishing domains |
| File hashes |
MD5 and SHA256 of suspicious files |
| File paths |
Malware locations, dropped files |
| Email addresses |
Phishing sender addresses |
| URLs |
Malicious URLs, C2 endpoints |
| User agents |
Unusual or known-malicious user agents |
Output Format
# Incident Triage Report
## Incident ID: [ID]
## Date/Time: [UTC]
## Severity: [Critical/High/Medium/Low]
## Classification: [incident type]
## Status: [Triage/Contained/Analyzing/Resolved]
### Summary
[2-3 sentence overview]
### Affected Systems
| Hostname | IP | Role | Status |
|----------|-----|------|--------|
### Timeline
| Time (UTC) | Event | Source | Notes |
|------------|-------|--------|-------|
### Indicators of Compromise
| Type | Value | Context | Confidence |
|------|-------|---------|------------|
### Containment Actions Taken
- [ ] [Action and result]
### Evidence Preserved
| Type | Location | Hash | Notes |
|------|----------|------|-------|
### Recommended Next Steps
1. [Immediate priority]
2. [Short-term action]
3. [Follow-up investigation]
### Escalation Checklist
- [ ] Management notified
- [ ] Legal notified (if data breach)
- [ ] Law enforcement (if applicable)
- [ ] Affected parties notified (if data breach)
Boundaries
- Focus on defense and containment, not counter-attack
- Preserve evidence — never modify logs or timestamps
- Recommend legal/management escalation for confirmed breaches
- If unsure about a containment action's impact, advise caution and ask
- Never recommend "hacking back" or retaliatory actions
- Refuse requests to cover up incidents or tamper with evidence
References
- NIST SP 800-61r2: Computer Security Incident Handling Guide
- SANS Incident Handler's Handbook
- MITRE ATT&CK Framework
1---2name: incident-triage3description: Guide rapid triage and initial response to security incidents following NIST SP 800-61 methodology. Use when the user mentions 'incident response,' 'security incident,' 'triage,' 'we've been hacked,' 'breach,' 'compromised,' 'malware detected,' 'suspicious activity,' 'IOC,' 'indicators of compromise,' or needs help handling a security event.4---5
6# Incident Triage — Security Incident Response
7
8Guide rapid triage and initial response to security incidents. Follow NIST SP 800-61 methodology.
9
10Cross-references: `siem-detection` for the rules that produced the alert this triage is responding to, `disk-forensics` for deeper disk and memory analysis once a host is contained, `breach-patterns` for the post-incident pattern extraction that hardens against recurrence, `soc-operations` for the operational layer above this skill (runbooks, escalation, handoff), `security-comms` for the stakeholder / customer notifications the response generates, `privacy-engineering` / `hipaa-audit` / `pci-audit` for the regulatory-clock determination when personal data, PHI, or cardholder data is involved, `ai-risk-management` for AI-specific incident classes (model failure, fairness drift, jailbreak exploitation in production).
11
12## Priorities (in order)
13
141. Preserve human safety
152. Contain the incident to prevent further damage
163. Preserve evidence for investigation
174. Identify root cause and scope
185. Document everything
19
20## Step 1: Classification
21
22Determine incident type:
23- **Malware:** ransomware, trojan, worm, cryptominer
24- **Unauthorized access:** compromised credentials, exploitation
25- **Data exfiltration:** data theft, insider threat
26- **Denial of service**
27- **Web compromise:** defacement, skimming, backdoor
28- **Phishing / social engineering**
29
30Determine severity:
31- **Critical:** active data exfiltration, ransomware spreading, critical system compromise
32- **High:** confirmed compromise, malware detected, unauthorized access
33- **Medium:** suspicious activity, potential indicators, failed attacks
34- **Low:** policy violation, reconnaissance detected, likely false positive
35
36## Step 2: Initial Containment
37
38Based on type and severity:
39- **Network:** block suspicious IPs/domains at firewall
40- **Host:** isolate affected system (network disconnect, NOT power off — volatile memory is evidence)
41- **Account:** disable compromised accounts, force password resets
42- **Application:** disable affected service if safe to do so
43
44**Critical: Do NOT power off systems.** Volatile memory contains evidence.
45
46## Step 3: Evidence Preservation
47
48Capture in order of volatility (most volatile first):
49
50```bash
51# 1. Running processes
52ps auxf # Linux
53tasklist /v # Windows
54
55# 2. Network connections
56ss -tupn # Linux
57netstat -anob # Windows
58
59# 3. Logged-in users
60who -a # Linux
61query user # Windows
62
63# 4. Open files
64lsof -nP # Linux
65
66# 5. System logs
67journalctl --since "1 hour ago" # Linux/systemd
68```
69
70If memory forensics tools are available (LiME, WinPmem), capture a memory dump before anything else.
71
72## Step 4: Initial Analysis
73
74For each suspicious indicator, document:
75- **What:** describe the artifact
76- **When:** timestamps in UTC
77- **Where:** affected system(s)
78- **How:** how it was detected
79
80Common analysis:
81- **Process tree:** look for unusual process names, paths, or parent-child relationships
82- **Network indicators:** unusual outbound connections, DNS queries to suspicious domains, beaconing patterns (regular intervals)
83- **File indicators:** recently modified files in unusual locations, hidden files, new executables
84- **Log analysis:** authentication failures, privilege escalation, service changes, cleared logs
85- **Persistence:** crontab, systemd units, registry Run keys, scheduled tasks, startup items
86
87## Step 5: IOC Extraction
88
89Extract and document all indicators of compromise:
90
91| Type | Examples |
92|------|---------|
93| IP addresses | Source and destination IPs |
94| Domains | C2 domains, phishing domains |
95| File hashes | MD5 and SHA256 of suspicious files |
96| File paths | Malware locations, dropped files |
97| Email addresses | Phishing sender addresses |
98| URLs | Malicious URLs, C2 endpoints |
99| User agents | Unusual or known-malicious user agents |
100
101## Output Format
102
103```markdown
104# Incident Triage Report
105## Incident ID: [ID]
106## Date/Time: [UTC]
107## Severity: [Critical/High/Medium/Low]
108## Classification: [incident type]
109## Status: [Triage/Contained/Analyzing/Resolved]
110
111### Summary
112[2-3 sentence overview]
113
114### Affected Systems
115| Hostname | IP | Role | Status |
116|----------|-----|------|--------|
117
118### Timeline
119| Time (UTC) | Event | Source | Notes |
120|------------|-------|--------|-------|
121
122### Indicators of Compromise
123| Type | Value | Context | Confidence |
124|------|-------|---------|------------|
125
126### Containment Actions Taken
127- [ ] [Action and result]
128
129### Evidence Preserved
130| Type | Location | Hash | Notes |
131|------|----------|------|-------|
132
133### Recommended Next Steps
1341. [Immediate priority]
1352. [Short-term action]
1363. [Follow-up investigation]
137
138### Escalation Checklist
139- [ ] Management notified
140- [ ] Legal notified (if data breach)
141- [ ] Law enforcement (if applicable)
142- [ ] Affected parties notified (if data breach)
143```
144
145## Boundaries
146
147- Focus on defense and containment, not counter-attack
148- Preserve evidence — never modify logs or timestamps
149- Recommend legal/management escalation for confirmed breaches
150- If unsure about a containment action's impact, advise caution and ask
151- Never recommend "hacking back" or retaliatory actions
152- Refuse requests to cover up incidents or tamper with evidence
153
154## References
155
156- NIST SP 800-61r2: Computer Security Incident Handling Guide
157- SANS Incident Handler's Handbook
158- MITRE ATT&CK Framework
briiirussell