Please enable JavaScript.
Coggle requires JavaScript to display documents.
10️⃣ Reporting Phase 📑 - Coggle Diagram
10️⃣ Reporting Phase 📑
Enterprise Incident Response Reporting Framework
Purpose 🎯
Convert technical incident activities into a documented business and security record
Provide evidence of what happened
Explain impact, timeline, root cause, and recovery actions
Support compliance requirements
Help management make security decisions
Improve future incident response capability
Reporting Lifecycle 🔄
1️⃣ Incident Detection Summary
What happened?
When was it detected?
Who detected it?
Which system was affected?
2️⃣ Incident Classification
Categorize incident type
Malware Infection 🦠
Unauthorized Access 🔓
Privilege Escalation ⬆️
Brute Force Attack 🔑
Data Breach 📂
Web Attack 🌐
Insider Activity 👤
Network Intrusion 🌍
Assign Severity Level
Critical 🔴
Business stopping impact
Data compromise
Root compromise
High 🟠
Important production system affected
Privileged account compromised
Medium 🟡
Limited impact
Suspicious activity detected
Low 🟢
Minor security event
Enterprise Reporting Preparation 🏢
Create Incident Report Directory Structure 📁
Linux Enterprise Path
/var/log/incident-response/
Main incident reporting location
/var/log/incident-response/cases/
Individual incident case folders
Example:
/var/log/incident-response/cases/
IR-2026-001/
incident-report.txt
timeline.log
evidence/
screenshots/
commands-output/
analyst-notes/
Create Directory
Command:
sudo mkdir -p /var/log/incident-response/cases
Explanation:
mkdir
Creates directory
-p
Creates parent directories automatically
/var/log
Standard Linux logging location
incident-response
Security investigation folder
Set Security Permissions 🔐
Command:
sudo chown root:security /var/log/incident-response
Explanation:
chown
Change ownership
root
Owner account
security
Security investigation group
Apply permissions:
sudo chmod 750 /var/log/incident-response
Meaning:
7
Root owner permissions
Read
Write
Execute
5
Security group permissions
Read
Execute
0
No access for others
Incident Report Components 📄
1️⃣ Executive Summary 🏢
Purpose:
High level explanation for management
Contains:
Incident description
Business impact
Affected systems
Current status
Risk level
Example:
"Linux production server was compromised through SSH brute force attack.
Unauthorized user gained access and malicious commands were executed."
2️⃣ Incident Identification Information 🔎
Report Fields:
Incident ID
Example:
IR-2026-001
Date and Time
Use UTC time standard
Command:
date -u
Reporter Information
Security analyst name
SOC team
Affected Host Information
Collect hostname:
hostname
Collect IP:
ip addr show
Collect operating system:
cat /etc/os-release
3️⃣ Incident Timeline ⏱️
Timeline shows complete attack sequence
Example:
02:10 UTC
Multiple failed SSH login attempts detected
02:15 UTC
Successful login from unknown IP
02:20 UTC
Privilege escalation detected
02:30 UTC
Host isolated
Create Timeline File:
touch timeline.log
Add events:
nano timeline.log
4️⃣ Technical Investigation Details 🔬
System Information Collection
Hostname:
hostnamectl
Kernel Information:
uname -a
Running Services:
systemctl list-units --type=service
Active Network Connections:
ss -tulpn
Logged Users:
who
w
5️⃣ Log Analysis Section 📜
Linux Authentication Logs
RHEL / CentOS:
/var/log/secure
Ubuntu / Debian:
/var/log/auth.log
Search Failed Login:
grep "Failed password" /var/log/auth.log
Search Successful Login:
grep "Accepted" /var/log/auth.log
System Logs:
/var/log/messages
/var/log/syslog
6️⃣ Evidence Summary 🧾
Evidence means:
Any data used to prove what happened
Evidence Types:
Log Files
/var/log/
User History
~/.bash_history
Process Information
ps aux
Network Information
ss -antp
File Metadata
stat filename
Evidence Directory:
/var/log/incident-response/cases/IR-2026-001/evidence/
7️⃣ Attack Indicators (IOC) 🚨
IOC means:
Indicator of Compromise
Examples:
Malicious IP Address
Suspicious Username
Malware Hash
Malicious File
Strange Process
Collect Running Processes:
ps aux
Check Open Ports:
netstat -tulpn
OR
ss -tulpn
8️⃣ Root Cause Analysis 🧠
Purpose:
Identify why incident happened
Questions:
How attacker entered?
Which vulnerability was used?
Why detection failed?
Which control failed?
Example:
Root Cause:
Weak SSH password policy
Contributing Factor:
No MFA enabled
Security Gap:
Missing monitoring rule
9️⃣ Impact Assessment 📊
Identify:
Confidentiality Impact
Data exposure
Integrity Impact
Data modification
Availability Impact
Service downtime
Business Impact:
Financial loss
Customer impact
Compliance violation
🔟 Response Actions Completed ✅
Document:
Containment actions
Investigation commands
Security fixes
Recovery steps
Example:
Disabled compromised user:
sudo usermod -L attacker
Blocked malicious IP:
sudo firewall-cmd --add-rich-rule
Removed malware:
rm suspicious-file
Reporting Tools Enterprise Level 🛠️
SIEM Integration
Elasticsearch
Store security events
Logstash
Process logs
Kibana
Create dashboards
Example Sources:
SSH Logs
Firewall Logs
Audit Logs
Linux Audit Framework
auditd
Configuration:
/etc/audit/auditd.conf
Service:
systemctl status auditd
Search Events:
ausearch -m USER_LOGIN
File Integrity Monitoring
AIDE
Configuration:
/etc/aide.conf
Database:
/var/lib/aide/
Check:
aide --check
Report Approval Workflow 🏢
Security Analyst
Creates technical report
SOC Lead
Reviews findings
Security Manager
Approves final report
Management
Receives executive summary
Compliance Team
Uses report for audit
Compliance Reporting 📋
NIST Incident Reporting
Incident identification
Detection timeline
Response actions
Lessons learned
ISO 27001
Security incident records
Corrective actions
Improvement tracking
Saudi NCA ECC
Cyber incident documentation
Evidence preservation
Security monitoring records
Final Incident Report Storage 📦
Secure Location:
/secure/incident-reports/
Permissions:
chmod 700 /secure/incident-reports
Backup:
rsync -av /secure/incident-reports /backup/incident-reports
Encryption:
gpg -c incident-report.txt
Enterprise Reporting Best Practices ⭐
Always use UTC timestamps
Never modify original evidence
Keep chain of custody
Record every command executed
Record analyst actions
Maintain incident ID
Protect report confidentiality
Store reports securely
Review after every incident
Improve security controls