Appendices

• Detailed technical analysis
• Evidence inventory
• Communication logs
• Cost impact analysis """
  # Prepare data for template analysis = self.analyze_incident()
  data = { 'incident_id': self.incident_id, 'review_date': self.review_date.strftime('%Y-%m-%d'), 'participants': ', '.join(self.participants), 'duration': str(self._calculate_duration()), 'detection_time': str(self._calculate_detection_time()), 'recovery_time': str(self._calculate_recovery_time()), 'timeline': self.timeline, 'root_causes': analysis['root_causes'], 'contributing_factors': analysis['contributing_factors'], 'successes': analysis['what_went_well'], 'failures': analysis['what_went_wrong'], 'lessons': self.lessons, 'improvements': self.improvements }
  # Render template env = jinja2.Environment() template_obj = env.from_string(template) report_md = template_obj.render(**data)
  # Convert to HTML report_html = markdown.markdown(report_md, extensions=['tables', 'fenced_code'])
  return report_html def track_improvements(self) -> Dict[str, Any]: """Track improvement implementation progress"""
  progress = { 'total_actions': len(self.improvements), 'completed': sum(1 for i in self.improvements if i.status == 'completed'), 'in_progress': sum(1 for i in self.improvements if i.status == 'in_progress'), 'pending': sum(1 for i in self.improvements if i.status == 'pending'), 'blocked': sum(1 for i in self.improvements if i.status == 'blocked'), 'completion_rate': 0.0 }
  if progress['total_actions'] > 0: progress['completion_rate'] = (progress['completed'] / progress['total_actions']) * 100
  return progress

Example usage

if name == "main": # Create incident review review = IncidentReview("INC-2024-001")

# Add participants
review.participants = ["Security Team", "IT Operations", "Management", "Legal"]

# Build timeline from incident data
events = [
    {
        'timestamp': '2024-01-15T08:00:00',
        'description': 'Initial phishing email received',
        'actor': 'external_attacker',
        'impact': 'none',
        'evidence': ['email_headers.txt']
    },
    {
        'timestamp': '2024-01-15T08:15:00',
        'description': 'User clicked phishing link and entered credentials',
        'actor': 'user_john_doe',
        'impact': 'credential_compromise',
        'evidence': ['proxy_logs.txt', 'auth_logs.txt']
    },
    {
        'timestamp': '2024-01-15T09:30:00',
        'description': 'Attacker accessed VPN with stolen credentials',
        'actor': 'external_attacker',
        'impact': 'network_access',
        'evidence': ['vpn_logs.txt']
    },
    {
        'timestamp': '2024-01-15T14:00:00',
        'description': 'Unusual data access pattern detected by DLP',
        'actor': 'dlp_system',
        'impact': 'detection',
        'evidence': ['dlp_alert.json']
    },
    {
        'timestamp': '2024-01-15T14:30:00',
        'description': 'Incident response team activated',
        'actor': 'soc_analyst',
        'impact': 'response_initiated',
        'evidence': ['incident_ticket.txt']
    },
    {
        'timestamp': '2024-01-15T15:00:00',
        'description': 'Compromised account disabled and VPN access revoked',
        'actor': 'security_admin',
        'impact': 'containment',
        'evidence': ['ad_logs.txt', 'vpn_revocation.txt']
    },
    {
        'timestamp': '2024-01-15T18:00:00',
        'description': 'Password reset completed for all users',
        'actor': 'it_admin',
        'impact': 'eradication',
        'evidence': ['password_reset_log.csv']
    },
    {
        'timestamp': '2024-01-16T09:00:00',
        'description': 'Enhanced monitoring deployed and incident closed',
        'actor': 'security_team',
        'impact': 'recovery_complete',
        'evidence': ['monitoring_config.yaml', 'incident_report.pdf']
    }
]

review.build_timeline(events)

# Add lessons learned
review.lessons.append(LessonLearned(
    category="Prevention",
    observation="Phishing email bypassed email security filters",
    root_cause="Email security not configured to check newly registered domains",
    recommendation="Update email security to flag emails from domains less than 30 days old",
    priority="High",
    owner="Email Security Team",
    due_date=datetime.date.today() + datetime.timedelta(days=30)
))

review.lessons.append(LessonLearned(
    category="Detection",
    observation="6-hour delay between compromise and detection",
    root_cause="No real-time monitoring of VPN access from unusual locations",
    recommendation="Implement geo-location based anomaly detection for VPN access",
    priority="High",
    owner="SOC Manager",
    due_date=datetime.date.today() + datetime.timedelta(days=45)
))

review.lessons.append(LessonLearned(
    category="Response",
    observation="Quick containment once detected",
    root_cause="Well-defined playbooks and automation",
    recommendation="Continue refining and expanding automated response capabilities",
    priority="Medium",
    owner="Security Engineering",
    due_date=datetime.date.today() + datetime.timedelta(days=90)
))

# Generate improvement plan
review.generate_improvement_plan()

# Generate report
report = review.generate_report()

# Save report
with open(f"lessons_learned_{review.incident_id}.html", "w") as f:
    f.write(report)

print(f"Lessons learned report generated for {review.incident_id}")
print(f"Total lessons identified: {len(review.lessons)}")
print(f"Total improvement actions: {len(review.improvements)}")

By implementing comprehensive incident response and recovery planning, organizations can effectively manage security incidents while continuously improving their security posture. This completes our journey through operating system security, from fundamental concepts to advanced incident management.