sica-fondt/knowledge/cyber-skills/skills/triaging-security-incident-with-ir-playbook/references/workflows.md

Incident Triage with IR Playbooks - Detailed Workflow

Triage Decision Tree

Alert Received
    |
    v
Is alert from trusted/tuned detection rule?
    |-- No --> Check rule logic, verify data source --> Potential false positive
    |-- Yes --> Continue
    |
    v
Does alert match known false positive pattern?
    |-- Yes --> Document, close as false positive, tune rule
    |-- No --> Continue
    |
    v
Can indicator be enriched with external threat intel?
    |-- Yes --> Enrich with VT, AbuseIPDB, OTX --> Add context
    |-- No --> Continue with available data
    |
    v
What is the incident type?
    |-- Malware --> Malware playbook
    |-- Phishing --> Phishing playbook
    |-- Unauthorized Access --> Access compromise playbook
    |-- Data Exfiltration --> Data breach playbook
    |-- Ransomware --> Ransomware playbook
    |-- DoS/DDoS --> Availability playbook
    |-- Insider Threat --> Insider playbook
    |
    v
Assign severity based on:
    - Asset criticality x Threat level x Data sensitivity
    |
    v
Route to appropriate team with playbook

Severity Assignment Matrix

Impact Score (1-4)

Score	Asset Criticality	Examples
4	Critical	Domain controllers, production databases, financial systems
3	High	Email servers, web applications, file servers
2	Medium	Development systems, internal tools
1	Low	Test systems, non-production workstations

Urgency Score (1-4)

Score	Threat Status	Indicators
4	Active exploitation	Ongoing attack, real-time data loss
3	Confirmed compromise	Evidence of breach, but not active
2	Attempted attack	Blocked attack, no evidence of success
1	Reconnaissance	Scanning, probing, no exploitation attempt

Final Severity = Impact x Urgency

Score Range	Severity	Response Time	Escalation
12-16	P1 Critical	Immediate (15 min)	CISO + IR Lead + Senior Analysts
8-11	P2 High	30 minutes	IR Lead + Available Analysts
4-7	P3 Medium	2 hours	Next available analyst
1-3	P4 Low	24 hours (business hours)	Queued for analyst review

Playbook Selection Guide

By Alert Source

Alert Source	Likely Playbook	Key Triage Actions
EDR - Malware detection	Malware IR	Check quarantine status, verify family
Email gateway - Phishing	Phishing IR	Extract IOCs, check delivery scope
SIEM - Authentication anomaly	Account Compromise	Verify account, check lateral movement
IDS/IPS - Exploit attempt	Vulnerability Exploitation	Verify patch status, check success
DLP - Data transfer	Data Exfiltration	Classify data, verify authorization
Cloud - Impossible travel	Cloud Account Compromise	Verify user, check API calls

By MITRE ATT&CK Tactic

Tactic	Playbook	Priority
Initial Access (TA0001)	Perimeter Breach	P1-P2
Execution (TA0002)	Malware/Code Execution	P1-P2
Persistence (TA0003)	Backdoor/Implant	P2
Privilege Escalation (TA0004)	Privilege Escalation	P1
Defense Evasion (TA0005)	Security Tool Bypass	P2
Credential Access (TA0006)	Credential Theft	P1-P2
Discovery (TA0007)	Reconnaissance	P3
Lateral Movement (TA0008)	Lateral Movement	P1
Collection (TA0009)	Data Staging	P2
Exfiltration (TA0010)	Data Breach	P1
Impact (TA0040)	Ransomware/Destruction	P1

IOC Enrichment Workflow

Step 1: Automated Enrichment

1. Submit IPs to VirusTotal, AbuseIPDB, Shodan
2. Submit file hashes to VirusTotal, MalwareBazaar, Hybrid Analysis
3. Submit domains to URLScan.io, VirusTotal, PassiveTotal
4. Check against internal IOC database and watchlists

Step 2: Context Addition

1. Look up asset in CMDB for criticality and owner
2. Check user in HR system for role and access level
3. Verify network zone and data classification
4. Cross-reference with recent threat intelligence reports

Step 3: Correlation

1. Search SIEM for related alerts in past 72 hours
2. Check if same IOCs appeared in other incidents
3. Correlate with ongoing threat campaigns
4. Verify if alert is part of a larger attack chain

Triage Documentation Requirements

1. Alert details (source, time, raw data)
2. Enrichment results (reputation scores, intelligence hits)
3. Classification decision (incident type, severity, justification)
4. Selected playbook and version
5. Assigned team/analyst
6. Initial timeline of observed events
7. Known affected assets and accounts