Beyond Incident Reporting - An Analysis of Structured Representations for Incident Response
summary
Compares existing formats (frameworks, playbook formats, granular command specs) and defines core concepts as workflow actuator action artifact, then adds criteria like aggregability, versioning, machine readability, confidentiality, authorization, prioritization. Finds cacao a practical choice for incident response sharing because it models playbooks and workflows, has Oasis backing and uses TLP/IEP for confidentiality. Proposes modeling organizational factors (GDPR, responsibility, team size) and a transformation engine that combines technical and org data to produce adapted playbooks; reports early interview validation and a published paper.
AI-written summary · about
chapters (12)
- 0:00Intro
- 5:05We observe a shift in perspective towards incident response representation.
- 9:54Standardization efforts have different objectives that support categorization.
- 10:45Incident response is defined by actuators, their actions, and artifacts.
- 15:46CACAO is a suitable candidate for incident response sharing.
- 17:00Playbooks contain different types of information relevant for incident response operations.
- 17:49We assume incident response is shaped by organization- specific factors.
- 18:53Do you think these factors do not influence the incident response process?
- 20:19Factors can modify the incident response process.
- 22:20Eventually, incident response factors can be used to separate playbook information.
- 23:32Proposing incident response factors is an on-going project.
- 25:01We conduct expert interviews to shed light on incident response factors.
related talks
38mArcana: A Unified Framework for Incident Response Documentation and Knowledge Management
41mHow to Keep Your Cool and Write Powerful Incident Response Reports
44mPanel: Peak Performance Under Pressure: Building Cross-Functional Resilience in Incident Response
23mEnforcing Your Code of Conduct: Effective Incident Response
29mComposing the Response: Building an Incident Pipeline from Scratch
49mTraining for Incident Response: The Red, the Blue, and the Ugly
36mModernizing Incident Response with LLMs, RAG, and the MCP
17mIncident Response @ Scale-Building a Next Generation SOC