Skip to content

Commit

Permalink
Add makefile.
Browse files Browse the repository at this point in the history
  • Loading branch information
chris committed Nov 14, 2019
1 parent 82fa40f commit b5dc040
Show file tree
Hide file tree
Showing 9 changed files with 343 additions and 175 deletions.
3 changes: 2 additions & 1 deletion .gitignore
Original file line number Diff line number Diff line change
@@ -1,5 +1,6 @@
# Processed Output:
public
build/
public/

# Editor configuration
.vscode/
Expand Down
32 changes: 32 additions & 0 deletions Makefile
Original file line number Diff line number Diff line change
@@ -0,0 +1,32 @@
all: public/plan.html

public/plan.html: public/plan.md build/_pandoc.yml
pandoc --toc --toc-depth=3 --standalone --output=public/plan.html build/_plan.md

public/plan.md: build/_plan.md
mkdir -p public
mustache info.yml build/_plan.md > public/plan.md
cp public/plan.md examples/example.md

build/_pandoc.yml: info.yml pandoc.yml
mkdir -p build
mustache info.yml pandoc.yml > build/_pandoc.yml

build/_plan.md: *.md playbooks/*.md reference/*.md roles/*.md
mkdir -p build
cat during.md \
playbooks/index.md playbooks/playbook-*.md \
roles/index.md roles/role-*.md \
after.md about.md > build/_plan.md

todo:
grep --color --recursive \
--exclude='Makefile' --exclude='README.md' \
--exclude-dir='public' --exclude-dir='build' --exclude-dir='examples' \
'TODO:' .

clean:
rm -rf public
rm -rf build

.PHONY: todo clean
95 changes: 41 additions & 54 deletions README.md
Original file line number Diff line number Diff line change
@@ -1,10 +1,14 @@
# About
# Incident Response Plan Template

## About

This template was developed by the team at [Counteractive Security](https://www.counteractive.net), to help all organizations get a good start on a concise, directive, specific, flexible, and free incident response plan. Build a [plan you will actually use](https://www.counteractive.net/posts/an-ir-plan-you-will-use/) to respond effectively, minimize cost and impact, and get back to business as soon as possible.

# Instructions
The latest release

## Instructions

## Download or fork this template
### Download or fork this template

The layout is as follows:

Expand All @@ -13,79 +17,47 @@ The layout is as follows:
* `roles/`: a folder containing descriptions of each role in the plan, along with duties and training notes. `index.md` contains the roles section header content, and each role should follow the convention `playbooks/role-[ORDER]-[NAME].md`.
* `after.md`: the guide to after-action review (_a.k.a._, hotwash, debrief, or post-mortem)---actions taken after an incident response.
* `about.md`: a footer containing information about the plan/template as a whole.
* `info.yaml`: a file containing values for the template strings throughout the plan (see below)
* `info.yml`: a file containing values for the template strings throughout the plan (see below)

## Find and replace template strings that `{{LOOK_LIKE_THIS}}`
### Customize `info.yml` with your organization's information

This is the [mustache](https://mustache.github.io/) syntax, and has wide support in a variety of tools and languages. The easiest way to replace these is to customize the `info.yaml` file with your organization's information and use a tool like the mustache cli to automatically find and replace all the relevant strings:
The template files have a lot of placeholders that `{{LOOK_LIKE_THIS}}`. The purpose of each placeholder should be discernable from context, and the [default `info.yml` file](./info.yml) is commented for additional clarity.

This is the [mustache](https://mustache.github.io/) template syntax, and has wide support in a variety of tools and languages. The easiest way to replace these is to customize the `info.yml` file with your organization's information and use the provided makefile (as of v1.0.0) to automatically find and replace all the relevant strings. In your terminal of choice (use [WSL](https://docs.microsoft.com/en-us/windows/wsl/faq) on Windows), type:

```bash
mustache info.yaml template.md > plan.md
make
```

These should be discernable from context, but the [default `info.yaml` file](./info.yaml) is commented for additional clarity.
If you don't have the information or tools referenced in the template variables, consider fixing that. **Especially** the critical information list (data you want to protect) and critical asset list (systems you want to protect).

This merges the template components, combines them with your custom data from `info.yml`, and outputs all supported formats in the `public/` directory. That's it.

If you don't have the things referenced in the variables, consider fixing that. **Especially** the critical information list (data you want to protect) and critical asset list (systems you want to protect).
*If you have a specific case and want more details, read on!*

## Customize
### Customize

1. Review all the `TODO` prompts for likely areas to customize, if desired. Delete them if no changes are required.
1. Add any roles or playbooks relevant to your organization. These can also be added over time.
1. Customize anything else! Whatever you feel is most effective for your organization.

## Build

Run whichever portions you like through [pandoc](https://pandoc.org/installing.html) to create your format of choice, or use the markdown files with [mkdocs](http://www.mkdocs.org/), [hugo](https://gohugo.io/), or countless other platforms.

### Response Plan Creation Example

Combine the template components:
### Deploy

```bash
cat during.md \
./playbooks/index.md ./playbooks/playbook-*.md \
./roles/index.md ./roles/role-*.md \
after.md about.md > plan-template.md
```
The makefile uses [pandoc](https://pandoc.org/installing.html) to create a variety of formats, or you can use the markdown files with [mkdocs](http://www.mkdocs.org/), [hugo](https://gohugo.io/), or countless other platforms.

Fill the template (and optionally, the pandoc metadata template):

```bash
mustache info.yaml plan-template.md > plan.md
mustache info.yaml pandoc.yaml > meta.yaml
```

Use pandoc to create the format of your choice (to `stdout` here, otherwise use `-o`):

```bash
pandoc --toc --toc-depth=3 --standalone --metadata-file=./meta.yaml
```

Or do it all in one shot with a little bash fifo magic:

```bash
mustache info.yaml \
<(cat during.md \
./playbooks/index.md ./playbooks/playbook-*.md \
./roles/index.md ./roles/role-*.md \
after.md about.md) \
| pandoc --toc --toc-depth=3 --standalone \
--metadata-file=<(mustache info.yaml pandoc.yaml)
```

## Example
### Example

An example is available in [the examples directory](./examples/example.md), where we leave the html rendering from markdown to github.

## Contact Us
### Contact Us

For professional assistance with incident response, or with customizing, implementing, or testing your plan, please contact us at [email protected] or [(888) 925-5765](tel:+18889255765).

# License
## License

This template is provided under the Apache License, version 2.0. See the [LICENSE](./LICENSE) and [NOTICE](./NOTICE) files for additional information.

# References and Additional Reading
## References and Additional Reading

* [Awesome Incident Response](https://github.com/meirwah/awesome-incident-response)
* [NIST Computer Security Incident Handling Guide](http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r2.pdf) (NIST)
Expand Down Expand Up @@ -115,13 +87,28 @@ This template is provided under the Apache License, version 2.0. See the [LICEN
* [EPA IR Plan](https://www.epa.gov/sites/production/files/2016-01/documents/cio_2150-p-08.2.pdf)
* [incidentresponse.com playbooks](https://www.incidentresponse.com/playbooks/)

# In Progress
## To do

* [x] After Action, lessons learned, process improvement
* [ ] Recovery
* [x] Recovery
* [x] Ransomware playbook
* [x] Easier build process
* [ ] Measures and Metrics
* [ ] Business priorities
* [ ] Testing procedure
* [ ] Communication and escalation tree, including executives
* [ ] Finance and budget
* [ ] Continuing to enhance modularity ("puzzle-piece" approach)

## Changelog

### v1.0.0 - First versioned production release

#### Added

* Added makefile and temporary directories to ease the build process

#### Changed

* Renamed `.yaml` files to `.yml`
* Updated README
Loading

0 comments on commit b5dc040

Please sign in to comment.