ir

Run incident response workflow for: $ARGUMENTS

Parse $ARGUMENTS: incident type is one of [compromise, ransomware, data-exfil, insider, malware, unknown] Optional second argument: affected system IP or hostname.

1. IR Kickoff:

   ═══════════════════════════════════════════════════
   INCIDENT RESPONSE START
   Type:      $ARGUMENTS
   Timestamp: $(date -u +%Y-%m-%dT%H:%M:%SZ)
   Operator:  $(whoami)
   ═══════════════════════════════════════════════════
   

   Create directories:

   mkdir -p evidence/$(date +%Y%m%d)/IR_$(date +%H%M%S)/{volatile,memory,logs,artifacts,iocs,timeline}
   IR_DIR=evidence/$(date +%Y%m%d)/IR_$(date +%H%M%S)
   

2. Type-Specific Checklist:

   compromise: Focus on initial access vector, persistence, lateral movement, credential theft ransomware: Focus on initial infection vector, encryption scope, shadow copy deletion, C2 communication data-exfil: Focus on data accessed, exfiltration method, destination IPs/domains insider: Focus on privileged access abuse, data downloads, account activity timeline malware: Focus on malware family identification, persistence, C2, affected hosts

3. Invoke dfir Agent: Delegate full triage with:

   • Incident type context
   • Volatile data capture first (processes, network, users)
   • Persistence mechanism hunting
   • Memory acquisition guidance (avml/LiME)
   • Log collection and analysis
   • Evidence directory: $IR_DIR

4. System Snapshot: Capture current state:

   # Snapshot current processes, network, users
   ps auxf > $IR_DIR/volatile/processes_$(date +%s).txt
   ss -tulnp > $IR_DIR/volatile/network_$(date +%s).txt
   who > $IR_DIR/volatile/users_$(date +%s).txt
   

5. IOC Extraction: Extract all IOCs to $IR_DIR/iocs/:

   • IP addresses from logs and network connections
   • Domain names from DNS and web logs
   • File hashes of suspicious executables
   • Registry keys (Windows), cron entries (Linux)
   • Malware indicators (mutex names, persistence paths)

6. Threat Hunt Integration: Invoke threat-hunter agent to find lateral movement:

   • Look for other systems the attacker may have reached
   • Correlate IOCs across available log sources

7. Timeline Build: Write UTC-ordered timeline to $IR_DIR/timeline/timeline.md:

   | UTC Timestamp | Event | Source | ATT&CK TTP | Significance |
   |---------------|-------|--------|------------|--------------|
   

8. Output Deliverables:

   ═══ IR DELIVERABLES ════════════════════════════
   immediate_actions.md  — Containment steps
   timeline.md           — UTC event timeline
   iocs.txt              — Indicators of compromise
   evidence_manifest.txt — Chain of custody log
   ════════════════════════════════════════════════
   
   Next: Share IOCs with security team
   Next: Brief stakeholders using immediate_actions.md
   

9. Write Evidence Manifest to $IR_DIR/evidence_manifest.txt:

   Chain of Custody — $ARGUMENTS — $(date -u +%Y-%m-%dT%H:%M:%SZ)
   Operator: $(whoami)
   Files collected:
   [list all files with sha256 hashes]