Security Incident Response

# Escalation procedures
P1 (Critical):
- Immediate notification to Incident Commander
- Escalate to CISO within 15 minutes
- Escalate to CEO within 30 minutes
- External notification within 1 hour

P2 (High):
- Notify Incident Commander within 30 minutes
- Escalate to CISO within 1 hour
- Escalate to CEO within 2 hours

P3 (Medium):
- Notify Security Team within 1 hour
- Escalate to Incident Commander within 4 hours

P4 (Low):
- Log and monitor
- Escalate if pattern emerges

#!/bin/bash
# incident_analysis.sh

INCIDENT_ID="$1"
ANALYST="$2"
TIMESTAMP=$(date +%Y%m%d_%H%M%S)

# Create incident directory
mkdir -p /incidents/$INCIDENT_ID
cd /incidents/$INCIDENT_ID

# Log initial information
echo "Incident ID: $INCIDENT_ID" > incident_log.txt
echo "Analyst: $ANALYST" >> incident_log.txt
echo "Timestamp: $TIMESTAMP" >> incident_log.txt
echo "Status: Under Investigation" >> incident_log.txt

# Collect system information
uname -a > system_info.txt
ps aux > running_processes.txt
netstat -tulpn > network_connections.txt
ss -tulpn >> network_connections.txt

# Collect log files
cp /var/log/auth.log auth_log.txt
cp /var/log/syslog syslog.txt
cp /var/log/messages messages.txt

# Collect network information
ip addr show > network_interfaces.txt
route -n > routing_table.txt
arp -a > arp_table.txt

# Collect file system information
find /tmp -type f -mtime -1 > recent_tmp_files.txt
find /var/log -name "*.log" -mtime -1 > recent_logs.txt

# Create analysis report
echo "Initial Analysis Report" > analysis_report.txt
echo "======================" >> analysis_report.txt
echo "Incident ID: $INCIDENT_ID" >> analysis_report.txt
echo "Analysis Date: $(date)" >> analysis_report.txt
echo "Analyst: $ANALYST" >> analysis_report.txt
echo "" >> analysis_report.txt
echo "Initial Findings:" >> analysis_report.txt
echo "- System compromised: [TBD]" >> analysis_report.txt
echo "- Attack vector: [TBD]" >> analysis_report.txt
echo "- Data affected: [TBD]" >> analysis_report.txt
echo "- Impact level: [TBD]" >> analysis_report.txt

echo "Initial analysis completed for incident $INCIDENT_ID"

#!/bin/bash
# containment_actions.sh

INCIDENT_ID="$1"
AFFECTED_SYSTEM="$2"
ACTION="$3"

case $ACTION in
    "isolate")
        # Isolate system from network
        iptables -A INPUT -s $AFFECTED_SYSTEM -j DROP
        iptables -A OUTPUT -d $AFFECTED_SYSTEM -j DROP
        echo "System $AFFECTED_SYSTEM isolated from network"
        ;;
    "lockout")
        # Lock out user accounts
        usermod -L $AFFECTED_SYSTEM
        echo "User account $AFFECTED_SYSTEM locked"
        ;;
    "shutdown")
        # Shutdown affected services
        systemctl stop $AFFECTED_SYSTEM
        systemctl disable $AFFECTED_SYSTEM
        echo "Service $AFFECTED_SYSTEM shutdown"
        ;;
    "quarantine")
        # Quarantine system
        systemctl stop networking
        echo "System quarantined - networking disabled"
        ;;
    "revoke")
        # Revoke access credentials
        # Remove from sudoers
        sed -i "/$AFFECTED_SYSTEM/d" /etc/sudoers
        # Remove SSH keys
        rm -f /home/$AFFECTED_SYSTEM/.ssh/authorized_keys
        echo "Access credentials revoked for $AFFECTED_SYSTEM"
        ;;
esac

# Log containment action
echo "$(date): $ACTION performed on $AFFECTED_SYSTEM for incident $INCIDENT_ID" >> /incidents/$INCIDENT_ID/containment_log.txt

#!/bin/bash
# system_recovery.sh

INCIDENT_ID="$1"
SYSTEM_NAME="$2"

echo "Starting recovery process for $SYSTEM_NAME (Incident: $INCIDENT_ID)"

# 1. Verify system is clean
echo "Verifying system is clean..."
clamscan -r / --infected --remove
rkhunter --check --skip-keypress

# 2. Apply security updates
echo "Applying security updates..."
apt update
apt upgrade -y
apt autoremove -y

# 3. Restore from backup
echo "Restoring from clean backup..."
# This would be specific to your backup solution
# Example: restore from clean snapshot

# 4. Update security configurations
echo "Updating security configurations..."
# Harden SSH
sed -i 's/#PermitRootLogin yes/PermitRootLogin no/' /etc/ssh/sshd_config
sed -i 's/#PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config
systemctl restart ssh

# 5. Enable monitoring
echo "Enabling enhanced monitoring..."
# Enable additional logging
echo "*.info /var/log/security.log" >> /etc/rsyslog.conf
systemctl restart rsyslog

# 6. Test system functionality
echo "Testing system functionality..."
systemctl status
netstat -tulpn
ps aux

echo "Recovery process completed for $SYSTEM_NAME"

# Internal Incident Notification Template
Subject: Security Incident Alert - [INCIDENT_ID] - [SEVERITY]

Incident Summary:
- Incident ID: [INCIDENT_ID]
- Severity: [SEVERITY]
- Detection Time: [TIMESTAMP]
- Affected Systems: [SYSTEMS]
- Initial Assessment: [ASSESSMENT]

Immediate Actions Taken:
- [ACTION_1]
- [ACTION_2]
- [ACTION_3]

Next Steps:
- [NEXT_STEP_1]
- [NEXT_STEP_2]

Contact Information:
- Incident Commander: [NAME] - [PHONE] - [EMAIL]
- Security Team: [PHONE] - [EMAIL]

This is an automated notification. Please do not reply to this email.

# Post-Incident Report Template

## Executive Summary
- Incident ID: [ID]
- Date Range: [START] to [END]
- Severity: [SEVERITY]
- Impact: [IMPACT]
- Root Cause: [ROOT_CAUSE]

## Incident Timeline
- Detection: [TIME]
- Response: [TIME]
- Containment: [TIME]
- Eradication: [TIME]
- Recovery: [TIME]

## Technical Details
- Attack Vector: [VECTOR]
- Affected Systems: [SYSTEMS]
- Data Compromised: [DATA]
- Tools Used: [TOOLS]

## Response Actions
- Immediate Actions: [ACTIONS]
- Containment Measures: [MEASURES]
- Recovery Steps: [STEPS]

## Lessons Learned
- What Went Well: [POSITIVES]
- What Could Be Improved: [IMPROVEMENTS]
- Root Cause Analysis: [ANALYSIS]

## Recommendations
- Short-term (0-30 days): [SHORT_TERM]
- Medium-term (1-6 months): [MEDIUM_TERM]
- Long-term (6+ months): [LONG_TERM]

## Action Items
- [ ] [ACTION_1] - [OWNER] - [DUE_DATE]
- [ ] [ACTION_2] - [OWNER] - [DUE_DATE]
- [ ] [ACTION_3] - [OWNER] - [DUE_DATE]

# Splunk SIEM Alert Rules
# Failed login attempts
index=security sourcetype=auth_logs "Failed password" | 
stats count by src_ip, user | 
where count > 5 | 
eval severity=if(count>10, "high", "medium")

# Privilege escalation
index=security sourcetype=auth_logs "sudo" | 
search user=* | 
stats count by src_ip, user, command | 
where count > 3

# Network anomalies
index=network sourcetype=firewall_logs | 
stats sum(bytes) by src_ip, dest_ip | 
where bytes > 1000000000 | 
eval severity="high"

# File integrity monitoring
index=security sourcetype=file_monitor | 
search action=modified | 
stats count by file_path, user | 
where count > 1

#!/bin/bash
# forensics_tools_install.sh

# Install Volatility (memory forensics)
pip3 install volatility3

# Install Autopsy (disk forensics)
wget https://github.com/sleuthkit/autopsy/releases/download/autopsy-4.19.0/autopsy-4.19.0_64bit.run
chmod +x autopsy-4.19.0_64bit.run
./autopsy-4.19.0_64bit.run

# Install Wireshark (network forensics)
apt install -y wireshark

# Install Sleuth Kit
apt install -y sleuthkit

# Install YARA (malware detection)
apt install -y yara

# Install ClamAV (antivirus)
apt install -y clamav clamav-daemon

# Install rkhunter (rootkit detection)
apt install -y rkhunter

# Install chkrootkit (rootkit detection)
apt install -y chkrootkit