Watch an on-demand demo video of EDR in action
Prefer a one-on-one demo? Click here
By clicking next I consent to the use of my personal data by Cynet in accordance with Cynet's Privacy Policy and by its partners
Incident response is a critical, highly sensitive activity in any organization. When security incidents happen, especially if they turn into major breaches involving damage to the organization and its clients, management needs to get involved. Senior managers will want to understand the impact of the incident and react to it.
As a leader, or member, of an incident response team, you’ll need a way to easily communicate the details of a security incident to management, taking into consideration that they are not security professionals.
This page provides a useful template with tables you can copy and paste into your reports or presentations to management, that will help them understand what happened in an incident, how your team responded, what remains to be done, and lessons learned.
When a major security incident occurs in your organization, you will be required to report to management about what happened during the incident, how the threat was mitigated and key systems recovered, and what are the lessons learned for next time.
It is important to communicate about the incident to your management both during the response, and after its conclusion. This will give them full visibility and knowledge into the event and its potential risk.
In this page, we provide a template you can use to clearly report to management about a major security incident, how it was handled, next steps and lessons learned.
Also be sure to check out our guide to incident response planning, and our list of incidvent response plan templates created by leading organizations.
Here is how to use our template to create your incident report for management:
Specify what happened in the incident, how you detected the threat, and the potential risk.
INCIDENT INVESTIGATION | ||||||
---|---|---|---|---|---|---|
Compromise | Privilege Escalation | Credential Theft | Lateral Movement | Data Access | Data Exfiltration | |
Threat | V | |||||
Details | SaaS account was compromised | Pass the Ticket – XXX server was accessed |
THREAT DETECTION | |||
---|---|---|---|
IN-HOUSE | 3RD PARTY | ||
Security Product Alert | Security team proactive | ||
Details | EDR raised an alert | Analyst spotted anomalous outbound traffic | FBI notification |
POTENTIAL RISK |
---|
Free text explaining the type of incident Example: Detected lateral movement might indicate an active malicious presence in the environment as well as other compromised assets |
Indicate who is managing the incident, whether there is a dedicated budget for responding or remediating the threat, and explain the next steps in the incident investigation process.
THREAT TYPE | ||
---|---|---|
In-House | IR Service Provider | |
Case Manager |
DEDICATED BUDGET | |
---|---|
Purpose | Sum |
INVESTIGATION DIRECTIONS |
---|
Free text in respect to the incident type
Example:
|
ESTIMATED TIMELINE |
---|
Discuss which part of the environment was penetrated, and what was done to contain the damage.
ROOT CAUSE | |
---|---|
Weaponized Email | v |
Malicious website | x |
Stolen credentials | |
Insider |
THREAT TYPE | ||
---|---|---|
Scope | Actions Taken | |
Number of compromised endpoints | 2 | Take offline |
Number of compromised servers | 3 | Take offline |
Number Compromised user accounts | 5 | Disable & Reset Password |
Number of encrypted endpoints | Reimage | |
Number of encrypted servers | Reimage |
Current Status | all discovered compromised entities are mitigated |
---|---|
Next Steps | investigate the attack’s scope |
Specify what was done, or planned to be done, to remove the threat in the interim phase, how it will be eradicated for good, and the success rate of different types of attacks conducted as part of the incident.
INTERIM STATUS | ||||
---|---|---|---|---|
Mass Ransomware | Malware | Compromised User Accounts | Malicious Outbound Traffic | |
Malicious Activity Type | XXX endpoints encrypted | XXX instances | XXX accounts | XXX sessions to XXX addresses |
Status | 54% back in production | 92% removed | 100% disabled and password reset | 100% blocked |
NEXT STEPS | ||||
---|---|---|---|---|
Mass Ransomware | Malware | Compromised User Accounts | Malicious Outbound Traffic | |
Malicious Activity Type | XXX endpoints encrypted | XXX instances | XXX accounts | XXX sessions to XXX addresses |
Status | Continue reimaging |
MALICIOUS INFRASTRUCTURE & ACTIVITY REMOVED | ||||
---|---|---|---|---|
Mass Ransomware | Malware | Compromised User Accounts | Malicious Outbound Traffic | |
Malicious Activity Type | XXX endpoints encrypted | XXX instances | XXX accounts | XXX sessions to XXX addresses |
Status | 100% reimaged | 100% removed | 100% reset | 100% blocked |
ATTACK DETAILS AND SUCCESS RATE | ||
---|---|---|
Details | Attack Success Rate | |
Data Theft | Insert info here | Insert info here |
Extortion | ||
Cryptomining | ||
Banking Credentials Harvesting | ||
Sabotage | ||
Other (specify) |
Explain your plan for returning affected endpoints, servers, apps, and other organizational assets to production.
Disabled/non available | Back to Production | |
---|---|---|
Endpoints | Insert info here | |
Servers | ||
Apps | ||
Cloud workloads | ||
User accounts | ||
Data |
Summarize the incident – what was the impact on the organization, what were the root causes that allows the attack to happen, the final timeline of the incident, and most importantly – what went well in the incident management process and what needs to be improved next time.
OVERALL ATTACK IMPACT | ||
---|---|---|
Damage | Details | |
Man hours | Insert info here | Insert info here |
Payment to 3rd party | ||
Data loss | ||
Computing charges for cloud provider | ||
Production downtime | ||
Fines (per respective regulation) |
Attack Enablers | Recommendations |
---|---|
Lack of sufficient security technology | Implement EDR\Deception\UBA\Network Analytics\XDR\other |
User insecure behavior | Train users on security best practices |
Other (specify) | Implement EDR\Deception\UBA\Network Analytics\XDR\other |
FINAL ATTACK TIMELINE | ||||
---|---|---|---|---|
Initial Compromise date | Insert date here | |||
Initial Compromise > Identification | Identification > Containment | Containment > Eradication | Eradication > Recovery | |
Time to conclude | Insert time here |
Identification | Containment | Eradication | Recovery | ||
---|---|---|---|---|---|
POINTS TO REPRODUCE | |||||
POINTS TO IMPROVE | Challenge | ||||
Recommendation |
Cynet provides a holistic solution for cybersecurity, including the Cynet Response Orchestration which can automate your incident response policy. Users can define automated playbooks, with pre-set or custom remediation actions for multiple attack scenarios. Cynet automated playbooks also help detect threats to ensure that you only implement a manual response when it is necessary.
Cynet Response Orchestration can address any threat that involves infected endpoints, malicious processes or files, attacker-controlled network traffic, or compromised user accounts.
Learn more about Cynet Response Orchestration.