Appendices

Appendices

All evidence and detailed logs are stored in: {self.incident_dir} """

    with open(f"{self.incident_dir}/incident-report.md", "w") as f:
        f.write(report)
        
    self.log_action("Incident Report Generated")
    
    return report

def main(): print("=== Security Incident Response System ===") print("WARNING: This will isolate the system and collect evidence")

confirm = input("Proceed with incident response? (yes/no): ")
if confirm.lower() != 'yes':
    print("Incident response cancelled")
    return
    
responder = IncidentResponder()

try:
    # Execute incident response steps
    responder.isolate_system()
    responder.collect_evidence()
    findings = responder.analyze_compromise()
    responder.contain_threat()
    recovery_plan = responder.create_recovery_plan()
    report = responder.generate_report()
    
    print("\n=== Incident Response Completed ===")
    print(f"Incident ID: {responder.incident_id}")
    print(f"Evidence stored in: {responder.incident_dir}")
    print(f"Findings: {len(findings)}")
    print("\nNext steps:")
    for step in recovery_plan['steps'][:3]:
        print(f"- {step['action']} ({step['responsible']})")
        
except Exception as e:
    responder.log_action("ERROR", str(e))
    print(f"Error during incident response: {e}")
    sys.exit(1)

if name == "main": # Ensure running as root if os.geteuid() != 0: print("This script must be run as root") sys.exit(1)

main()