Activate IR Plan →

⚡ Incident Classification

AUTO-TRACKED

Generated Incident ID

IR-2025-0000

Incident Title *

Severity Classification *

Low

Medium

High

Critical

Primary Playbook

Reporting Vector

Detailed Description & Initial IOCs

Supports STIX 2.1, MITRE ATT&CK mapping, and raw log paste.

Affected Systems / Assets

📡 Notification & Escalation

Legal & Compliance - Notify General Counsel & Regulatory Affairs Communications - Activate PR crisis comms channel Executive Leadership - C-Suite & Board Risk Committee External CIRT - Engage CyberVault Tier-4 Incident Response Team Evidence Chain of Custody - Enable forensic imaging & log preservation protocol

📋 Activation Checklist

○

Classify Severity LevelRequired for routing matrix

○

Enter Incident TitleClear descriptive identifier

○

Provide Initial DescriptionMinimum 20 characters

○

Select Response PlaybookAuto-maps to MITRE ATT&CK

○

Configure NotificationsMin. 1 channel required

🔗 Quick Reference

SOAR Integration: Auto-provisioning of response containers, network segmentation, and credential rotation upon activation.

Audit Trail: All actions are cryptographically signed and logged to immutable ledger per ISO 27001:2022.

Support: IR Hotline: +1 (800) 555-SEC-911
Encrypted Channel: vault://ir-secure/c2

⚠️ Activation Notice

Triggering this plan will immediately execute automated containment protocols, notify selected stakeholders, and allocate dedicated SOC resources. Cannot be reversed without CISO authorization. Ensure all initial IOCs are documented before proceeding.