Incident Response

Triage, Forensics & Escalation Workflows

🧪 Triage Scripts (CLI)

CommandPurpose
who -aCheck active sessions and logins
netstat -tulnpList active network connections
ps aux --sort=-%cpuIdentify high CPU processes
df -hCheck disk usage
uptimeReview system load and uptime

🔍 Forensic Tools

ToolPurpose
AutopsyGUI-based digital forensics platform
VolatilityAnalyze memory dumps for artifacts
FTK ImagerCreate forensic disk images
WiresharkCapture and analyze network traffic
ChkrootkitScan for rootkits on Unix systems

📈 Escalation Logic

StepAction
1. ContainIsolate affected systems from network
2. PreserveCapture logs, memory, and disk images
3. AnalyzeUse forensic tools to identify root cause
4. ReportDocument findings and notify stakeholders
5. RecoverRestore systems and monitor for recurrence