yaml 12 lines · 1 tab

Incident response severity matrix and first hour checklist

Kai Nakamura Apr 2026

1 tab

severities:
  sev1: customer-impacting active compromise or confirmed data exposure
  sev2: high risk suspicious activity with potential customer impact
  sev3: contained issue with low current impact

first_hour:
  - identify incident commander
  - capture volatile evidence
  - contain without destroying evidence
  - rotate potentially exposed credentials
  - notify stakeholders based on severity
  - start incident log with UTC timestamps

1 file · yaml Explain with highlit

The first hour of an incident should be structured enough that teams do not invent process under pressure. I keep severity definitions, communication paths, and containment priorities explicit. A good checklist reduces panic and preserves evidence at the same time.

Related snips

plaintext

rule SuspiciousDownloader {
  strings:
    $a = "powershell -enc" nocase
    $b = "Invoke-WebRequest" nocase
    $c = "http://" nocase
  condition:

YARA rules for spotting suspicious binaries during triage

yara malware triage

by Kai Nakamura 1 tab

bash

#!/usr/bin/env bash
set -euo pipefail

# ==========================================================
# Production Incident Response Runbook
# ==========================================================

Incident response runbook and diagnostic scripts

incident-response sre production

by Ryan Nakamura 1 tab

bash

#!/usr/bin/env bash
set -euo pipefail

OUT="/tmp/incident-$(date +%Y%m%d-%H%M%S)"
mkdir -p "$OUT"

Forensic collection script for volatile host evidence

forensics incident-response linux

by Kai Nakamura 1 tab

bash

#!/usr/bin/env bash
tcpdump -i eth0 host 10.10.20.15 -w suspect-host.pcap
tcpdump -i eth0 port 443 and host api.example.com
tcpdump -i eth0 'tcp[tcpflags] & (tcp-syn|tcp-fin|tcp-rst) != 0'

tcpdump filters for fast packet capture during investigations

tcpdump packets incident-response

by Kai Nakamura 1 tab

plaintext

http.response.code >= 400
tcp.analysis.retransmission
tls.alert_message
dns.flags.response == 1 && dns.a
ip.addr == 10.10.20.15 && tcp.port == 443

Wireshark display filters that speed up incident triage

wireshark packet-analysis incident-response

by Kai Nakamura 1 tab

Share this code

Here's the card — post it anywhere.

Incident response severity matrix and first hour checklist — share card

Link copied