PROBLEM
The IR framework is on a slide, but at alert time there is no timeline and no isolation owner.
PODEJŚCIE
A few lab scenarios with a checklist: what to collect, whom to ask, what to write down.
ARCHITECTURE
- endpoints from the SOC lab
- alert from Wazuh or a raw log
- note template
IMPLEMENTATION
- IR checklist
- ATT&CK mapping where the log actually covers it
- “alert ≠ incident” drills
RESULT
- IR checklist as a resource
- scenarios in progress, no SLA metrics
LESSONS
- isolation without an owner is theatre
Goal
The IR lab trains decisions on lab data, not a corporate playbook copied from NIST with no context.
Two problems I solved
1. A framework with no timeline
I knew IR phases from a slide, but at alert time I had no habit for: what happened, since when, on which host, who can approve isolation.
What I gained: a start checklist and a note template: facts, hypotheses, gaps, decision. The public IR checklist comes from these drills — not decoration.
2. Treating every alert as an incident
Every red tile “looked like an attack”. Discipline was missing: triage first, escalate second.
What I gained: “alert ≠ incident” practice on lab telemetry (Wazuh / Event Log). I can justify ignore, watch or escalate — and write down what I still do not know.
Exercise flow
- Intake: alert source, host, account, time (with zone).
- Preserve material: logs, capture, note — before someone “cleans up”.
- Isolation only with an owner.
- ATT&CK mapping only when the log covers the technique.
- Escalation note or close with rationale.
Related material
Boundaries
No 24/7 retainer, no “we evict the attacker in 15 minutes”, no work on someone else’s production without scope.
Status
development. The checklist is public; full telemetry scenarios land together with the SOC/Wazuh lab.