Incident summary

As explained in Cyber Threat Hunting

An incident summary is a structured report of a security incident's circumstances, effects, response, and next steps.

An incident summary is a structured, executive-level report of what happened, why it happened, detection delays, business and customer effects, response actions, and next steps. section 12.5.1

Build the summary around these fields:

• Name the incident, category, and severity. section 12.5.1
• Describe the incident overview, including the affected system, unexpected activity, exploitation, and adversary behavior. section 12.5.1
• Record the incident effect, response, timeline, and planned next steps. section 12.5.1

Patient records exposed

A major incident involved an insecure application configuration. A compromised partner system dumped more than 10,000 patient records containing personally identifiable information from a backend database. The summary highlights how the threat was uncovered, why detection took more than two months, the effect on patients and the business, and the response. section 12.5.1

Figure 12.3 Sample executive report on a major security incident that a CISO would share with the executive team (the same details added in the section)

Use the sample executive report layout to organize the incident facts and communicate threat-hunting contributions. section 12.5.1

Figure 12.4 Incident timeline

Use the incident timeline to show important dates and make delayed detection visible. section 12.5.1

How Cyber Threat Hunting covers it

How deep it goes

Defines report fields and executive questions, then illustrates them through a major incident and timeline.

Examples

Uses a compromised partner, exposed patient records, application exploitation, delayed detection, and a sample executive report.

What it assumes

Assumes familiarity with security incidents and executive stakeholders while identifying the questions a summary must answer.

What you can do after

Evaluate/understand an incident’s circumstances, effects, response, detection delay, and next steps at executive level.

How it connects

Connects incident reporting with threat hunting, incident timelines, detection, response, and executive dashboards.

liveBookmanning.com

Read Cyber Threat Hunting on liveBook Get the book at manning.com

This explainer was generated by Manning's knowledge graph from the text of Cyber Threat Hunting. The section links point to the parts of the book it draws on.