security-incident-reporting

这段内容是审核时保存的快照。外部来源才是完整且最新的版本。

---
name: "security-incident-reporting"
description: "Builds security incident reports, DDoS post-mortems, timelines, IoC sections, CVE correlation, severity scoring, and blameless root cause analysis. Use when the user needs an incident report, post-mortem, forensics summary, security timeline, DDoS analysis, SIR, root cause analysis, or communication for a security event."
metadata:
  version: "1.0.0"
  origin: "webconsulting"
license: "MIT / CC-BY-SA-4.0"
---
# Security Incident Reporting

> Source: https://github.com/dirnbauer/webconsulting-skills

Comprehensive framework for documenting and analyzing security incidents, drawing from NIST SP 800-61 and SANS methodologies.

## When to Use

- After a security incident (DDoS, breach, vulnerability exploitation)
- Creating post-mortem documentation
- Communicating with stakeholders (C-level, legal, security teams)
- Correlating attack patterns with known CVEs
- Establishing incident response metrics (MTTR, dwell time)

## Related Skills

- [security-audit](../security-audit/SKILL.md) - Pre-incident vulnerability assessment
- [typo3-security](../typo3-security/SKILL.md) - TYPO3 hardening
- [SKILL-TYPO3.md](./SKILL-TYPO3.md) - TYPO3-specific incident reporting

---

## 1. Incident Response Framework

### NIST SP 800-61 / SANS Harmonization

| Phase | NIST | SANS | Documentation Focus |
|-------|------|------|---------------------|
| 1 | Preparation | Preparation | Runbooks, contacts, tools |
| 2 | Detection & Analysis | Identification | Initial detection, triage |
| 3 | Containment | Containment | Isolation actions, timeline |
| 4 | Eradication | Eradication | Root cause removal |
| 5 | Recovery | Recovery | Service restoration |
| 6 | Post-Incident | Lessons Learned | Post-mortem, improvements |

### Documentation Principle

> **Logbuch-Prinzip**: Document in real-time during the incident, then consolidate into the post-mortem report. Never create reports retrospectively from memory.

---

## 2. Severity Rating Systems

### NCISS (National Cyber Incident Scoring System)

| Level | Score | Description |
|-------|-------|-------------|
| Emergency (1) | 100 | Nation-state attack, critical infrastructure |
| Severe (2) | 80-99 | Significant impact, data exfiltration |
| High (3) | 60-79 | Service disruption, potential data loss |
| Medium (4) | 40-59 | Limited impact, contained breach |
| Low (5) | 20-39 | Minor incident, no data loss |
| Baseline (6) | 0-19 | Informational, false positive |

### DDoS Resiliency Score (DRS)

| Level | Description | Typical Bandwidth |
|-------|-------------|-------------------|
| 1-2 | Simple Floods | < 1 Gbps |
| 3-4 | Sophisticated Multi-Vector | 1-5 Gbps |
| 5-6 | Advanced (State-Actor Level) | 5-100 Gbps |
| 7 | Extreme (Hyper-Volumetric) | > 100 Gbps |

### CVSS Integration

For vulnerability-based incidents, include CVSS 4.0 base score (v3.1 accepted for legacy reports) from the [security-audit](../security-audit/SKILL.md) skill.

---

## 3. Incident Report Template

### Module A: Metadata & Executive Summary

```markdown
# Security Incident Report

## Metadata
| Field | Value |
|-------|-------|
| Incident ID | SIR-2026-001 |
| Classification | Confidential |
| Status | Closed / Active / Under Investigation |
| Detection Time | 2026-01-21 14:32 UTC |
| Resolution Time | 2026-01-21 15:17 UTC |
| MTTR | 45 minutes |
| Severity | High (NCISS: 65) |
| Lead Analyst | Jane Doe |
| Affected Systems | web-cluster-01, cdn-edge-eu |

## Executive Summary (max 200 words)

On [DATE], our monitoring systems detected [INCIDENT TYPE] targeting [SYSTEMS].
The attack [IMPACT DESCRIPTION]. Through [RESPONSE ACTIONS], normal operations
were restored within [TIMEFRAME]. [DATA IMPACT STATEMENT].

### Business Impact
- Service Availability: [Degraded/Offline for X minutes]
- Data Impact: [None/Potential exposure of X records]
- Financial Impact: [Estimated cost]
- Reputation Impact: [Public/Internal]
```

### Module B: Timeline (Chronological Analysis)

```markd