Skip to content

08_Response_Workflow.md

Latest commit

 

History

History
189 lines (123 loc) · 3.3 KB

08_Response_Workflow.md

File metadata and controls

189 lines (123 loc) · 3.3 KB
Raw

08 - Incident Response Workflow

1. Objective

This document defines the structured response workflow for handling suspicious API enumeration activity within the Factory Monitoring Application.

The workflow aligns with standard SOC and Incident Response (IR) procedures.

2. Incident Response Phases

The response follows the standard lifecycle:

  1. Detection
  2. Triage
  3. Investigation
  4. Containment
  5. Eradication
  6. Recovery
  7. Lessons Learned

3. Phase 1 – Detection

Trigger Source:

  • SIEM Alert: "Cross-Factory Enumeration"
  • Wildcard Enumeration Rule Trigger
  • Behavioral Anomaly Detection

SOC Analyst Action:

  • Validate alert authenticity
  • Confirm IP address and user ID
  • Check alert severity level
  • Open incident ticket

4. Phase 2 – Triage

Objectives:

  • Determine if behavior is legitimate
  • Identify user role
  • Assess data sensitivity
  • Evaluate activity frequency

Actions:

  • Review user account details
  • Correlate login history
  • Check for previous similar alerts
  • Verify whether account belongs to admin or engineer

Decision Point:

  • False Positive → Close ticket
  • Suspicious Activity → Escalate to Investigation

5. Phase 3 – Investigation

Scope:

  • Full log review for past 24–72 hours
  • Identify additional enumeration attempts
  • Check for data exfiltration patterns
  • Review authentication anomalies

Artifacts to Collect:

  • Access logs
  • Session details
  • User role mapping
  • API request frequency metrics

Goal:

Determine whether activity indicates:

  • Insider misuse
  • Compromised credentials
  • Legitimate operational need

6. Phase 4 – Containment

If confirmed suspicious:

Immediate Actions:

  • Temporarily disable user account
  • Revoke active sessions
  • Block suspicious IP (if required)
  • Reset user credentials

Objective:

Prevent further enumeration or data exposure.

7. Phase 5 – Eradication

Actions:

  • Remove excessive API permissions
  • Patch API wildcard vulnerability
  • Apply rate limiting
  • Implement stricter role validation

Ensure no persistence mechanisms exist.

8. Phase 6 – Recovery

Steps:

  • Restore user access (if legitimate)
  • Monitor account for 7–14 days
  • Validate logging and alerting improvements
  • Confirm normal system operations

9. Phase 7 – Lessons Learned

Post-Incident Review Meeting:

  • Identify detection gaps
  • Review response time
  • Evaluate control weaknesses
  • Update detection logic

Update Documentation:

  • Refine SIEM rules
  • Improve threshold baselines
  • Update SOC playbooks

10. Escalation Matrix

Severity Escalation Level
Low SOC Analyst
Medium SOC Lead
High Incident Response Team
Critical CISO & Management

Current Case Severity: High

Escalation Level: Incident Response Team

11. SLA Targets

Phase Target Time
Alert Review 15 minutes
Triage Completion 1 hour
Containment < 2 hours
Full Investigation 24 hours

12. Workflow Summary

Detection → Triage → Investigation → Containment → Eradication → Recovery → Lessons Learned

This structured workflow ensures rapid response, minimal operational disruption, and continuous improvement in SOC monitoring capability.

Prepared By: Incident Response & SOC Operations Team (Simulation)