INCIDENT_RESPONSE

Category: 09. Cybersecurity
Section: Phase 2: Technical Blueprint

8. INCIDENT_RESPONSE.md

Purpose: To define detection, containment, eradication, recovery, and lessons learned.

Act as a senior incident response specialist.
Using the PRD and Threat Model below, create an Incident Response document for a cybersecurity hackathon project.

PRD: [PASTE PRD]
THREAT_MODEL: [PASTE THREAT_MODEL]

Provide:
1. Incident response phases (Preparation, Detection, Containment, Eradication, Recovery, Lessons Learned)
2. Incident classification (Severity levels)
3. Detection sources (Logs, Alerts, User reports)
4. Triage process (How to assess severity)
5. Containment strategies (Isolate, Block, Disable)
6. Eradication steps (Remove threat, Patch vulnerabilities)
7. Recovery steps (Restore systems, Verify integrity)
8. Communication plan (Who to notify, When)
9. Evidence collection (Forensics, Chain of custody)
10. Post-incident review (What went well, What to improve)
11. Example incident scenario (Step-by-step)
12. A checklist for verifying the incident response plan before the demo

Explain each phase in beginner-friendly language.
Keep the incident response plan simple and realistic for a hackathon.