-
Notifications
You must be signed in to change notification settings - Fork 223
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
chris
committed
Nov 14, 2019
1 parent
82fa40f
commit b5dc040
Showing
9 changed files
with
343 additions
and
175 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -1,5 +1,6 @@ | ||
# Processed Output: | ||
public | ||
build/ | ||
public/ | ||
|
||
# Editor configuration | ||
.vscode/ | ||
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,32 @@ | ||
all: public/plan.html | ||
|
||
public/plan.html: public/plan.md build/_pandoc.yml | ||
pandoc --toc --toc-depth=3 --standalone --output=public/plan.html build/_plan.md | ||
|
||
public/plan.md: build/_plan.md | ||
mkdir -p public | ||
mustache info.yml build/_plan.md > public/plan.md | ||
cp public/plan.md examples/example.md | ||
|
||
build/_pandoc.yml: info.yml pandoc.yml | ||
mkdir -p build | ||
mustache info.yml pandoc.yml > build/_pandoc.yml | ||
|
||
build/_plan.md: *.md playbooks/*.md reference/*.md roles/*.md | ||
mkdir -p build | ||
cat during.md \ | ||
playbooks/index.md playbooks/playbook-*.md \ | ||
roles/index.md roles/role-*.md \ | ||
after.md about.md > build/_plan.md | ||
|
||
todo: | ||
grep --color --recursive \ | ||
--exclude='Makefile' --exclude='README.md' \ | ||
--exclude-dir='public' --exclude-dir='build' --exclude-dir='examples' \ | ||
'TODO:' . | ||
|
||
clean: | ||
rm -rf public | ||
rm -rf build | ||
|
||
.PHONY: todo clean |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -1,10 +1,14 @@ | ||
# About | ||
# Incident Response Plan Template | ||
|
||
## About | ||
|
||
This template was developed by the team at [Counteractive Security](https://www.counteractive.net), to help all organizations get a good start on a concise, directive, specific, flexible, and free incident response plan. Build a [plan you will actually use](https://www.counteractive.net/posts/an-ir-plan-you-will-use/) to respond effectively, minimize cost and impact, and get back to business as soon as possible. | ||
|
||
# Instructions | ||
The latest release | ||
|
||
## Instructions | ||
|
||
## Download or fork this template | ||
### Download or fork this template | ||
|
||
The layout is as follows: | ||
|
||
|
@@ -13,79 +17,47 @@ The layout is as follows: | |
* `roles/`: a folder containing descriptions of each role in the plan, along with duties and training notes. `index.md` contains the roles section header content, and each role should follow the convention `playbooks/role-[ORDER]-[NAME].md`. | ||
* `after.md`: the guide to after-action review (_a.k.a._, hotwash, debrief, or post-mortem)---actions taken after an incident response. | ||
* `about.md`: a footer containing information about the plan/template as a whole. | ||
* `info.yaml`: a file containing values for the template strings throughout the plan (see below) | ||
* `info.yml`: a file containing values for the template strings throughout the plan (see below) | ||
|
||
## Find and replace template strings that `{{LOOK_LIKE_THIS}}` | ||
### Customize `info.yml` with your organization's information | ||
|
||
This is the [mustache](https://mustache.github.io/) syntax, and has wide support in a variety of tools and languages. The easiest way to replace these is to customize the `info.yaml` file with your organization's information and use a tool like the mustache cli to automatically find and replace all the relevant strings: | ||
The template files have a lot of placeholders that `{{LOOK_LIKE_THIS}}`. The purpose of each placeholder should be discernable from context, and the [default `info.yml` file](./info.yml) is commented for additional clarity. | ||
|
||
This is the [mustache](https://mustache.github.io/) template syntax, and has wide support in a variety of tools and languages. The easiest way to replace these is to customize the `info.yml` file with your organization's information and use the provided makefile (as of v1.0.0) to automatically find and replace all the relevant strings. In your terminal of choice (use [WSL](https://docs.microsoft.com/en-us/windows/wsl/faq) on Windows), type: | ||
|
||
```bash | ||
mustache info.yaml template.md > plan.md | ||
make | ||
``` | ||
|
||
These should be discernable from context, but the [default `info.yaml` file](./info.yaml) is commented for additional clarity. | ||
If you don't have the information or tools referenced in the template variables, consider fixing that. **Especially** the critical information list (data you want to protect) and critical asset list (systems you want to protect). | ||
|
||
This merges the template components, combines them with your custom data from `info.yml`, and outputs all supported formats in the `public/` directory. That's it. | ||
|
||
If you don't have the things referenced in the variables, consider fixing that. **Especially** the critical information list (data you want to protect) and critical asset list (systems you want to protect). | ||
*If you have a specific case and want more details, read on!* | ||
|
||
## Customize | ||
### Customize | ||
|
||
1. Review all the `TODO` prompts for likely areas to customize, if desired. Delete them if no changes are required. | ||
1. Add any roles or playbooks relevant to your organization. These can also be added over time. | ||
1. Customize anything else! Whatever you feel is most effective for your organization. | ||
|
||
## Build | ||
|
||
Run whichever portions you like through [pandoc](https://pandoc.org/installing.html) to create your format of choice, or use the markdown files with [mkdocs](http://www.mkdocs.org/), [hugo](https://gohugo.io/), or countless other platforms. | ||
|
||
### Response Plan Creation Example | ||
|
||
Combine the template components: | ||
### Deploy | ||
|
||
```bash | ||
cat during.md \ | ||
./playbooks/index.md ./playbooks/playbook-*.md \ | ||
./roles/index.md ./roles/role-*.md \ | ||
after.md about.md > plan-template.md | ||
``` | ||
The makefile uses [pandoc](https://pandoc.org/installing.html) to create a variety of formats, or you can use the markdown files with [mkdocs](http://www.mkdocs.org/), [hugo](https://gohugo.io/), or countless other platforms. | ||
|
||
Fill the template (and optionally, the pandoc metadata template): | ||
|
||
```bash | ||
mustache info.yaml plan-template.md > plan.md | ||
mustache info.yaml pandoc.yaml > meta.yaml | ||
``` | ||
|
||
Use pandoc to create the format of your choice (to `stdout` here, otherwise use `-o`): | ||
|
||
```bash | ||
pandoc --toc --toc-depth=3 --standalone --metadata-file=./meta.yaml | ||
``` | ||
|
||
Or do it all in one shot with a little bash fifo magic: | ||
|
||
```bash | ||
mustache info.yaml \ | ||
<(cat during.md \ | ||
./playbooks/index.md ./playbooks/playbook-*.md \ | ||
./roles/index.md ./roles/role-*.md \ | ||
after.md about.md) \ | ||
| pandoc --toc --toc-depth=3 --standalone \ | ||
--metadata-file=<(mustache info.yaml pandoc.yaml) | ||
``` | ||
|
||
## Example | ||
### Example | ||
|
||
An example is available in [the examples directory](./examples/example.md), where we leave the html rendering from markdown to github. | ||
|
||
## Contact Us | ||
### Contact Us | ||
|
||
For professional assistance with incident response, or with customizing, implementing, or testing your plan, please contact us at [email protected] or [(888) 925-5765](tel:+18889255765). | ||
|
||
# License | ||
## License | ||
|
||
This template is provided under the Apache License, version 2.0. See the [LICENSE](./LICENSE) and [NOTICE](./NOTICE) files for additional information. | ||
|
||
# References and Additional Reading | ||
## References and Additional Reading | ||
|
||
* [Awesome Incident Response](https://github.com/meirwah/awesome-incident-response) | ||
* [NIST Computer Security Incident Handling Guide](http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r2.pdf) (NIST) | ||
|
@@ -115,13 +87,28 @@ This template is provided under the Apache License, version 2.0. See the [LICEN | |
* [EPA IR Plan](https://www.epa.gov/sites/production/files/2016-01/documents/cio_2150-p-08.2.pdf) | ||
* [incidentresponse.com playbooks](https://www.incidentresponse.com/playbooks/) | ||
|
||
# In Progress | ||
## To do | ||
|
||
* [x] After Action, lessons learned, process improvement | ||
* [ ] Recovery | ||
* [x] Recovery | ||
* [x] Ransomware playbook | ||
* [x] Easier build process | ||
* [ ] Measures and Metrics | ||
* [ ] Business priorities | ||
* [ ] Testing procedure | ||
* [ ] Communication and escalation tree, including executives | ||
* [ ] Finance and budget | ||
* [ ] Continuing to enhance modularity ("puzzle-piece" approach) | ||
|
||
## Changelog | ||
|
||
### v1.0.0 - First versioned production release | ||
|
||
#### Added | ||
|
||
* Added makefile and temporary directories to ease the build process | ||
|
||
#### Changed | ||
|
||
* Renamed `.yaml` files to `.yml` | ||
* Updated README |
Oops, something went wrong.