How to Keep Your Cool and Write Powerful Incident Response Reports
summary
Shows how incident reports that get read and drive action use concrete specifics: cite the CVE and OpenSSH exploit, show log analysis and PCAPs in an appendix, and state confidence levels for root‑cause claims. Use the NIST phases identify, contain, eradicate, recover, provide a lessons‑learned table with action owner and start date, and attach a Word/PDF template (used at Axonius) plus a checklist. Recommend a one‑week window to push fixes and an editing goal to cut drafts by ~20%.
AI-written summary · about
chapters (15)
- 0:00Incident response storytelling
- 1:50Goals for reports
- 3:58Challenge of concise writing
- 6:56What readers want
- 8:23What happened and impact
- 12:41Root cause analysis
- 16:27NIST framework steps
- 19:39Lessons learned and change
- 23:10Cybersecurity writing elements
- 23:51Choosing report tone
- 27:22Avoid wordiness and passives
- 33:10Prioritize key info
- 36:25Report structure
- 39:15Five writing aspects summary
- 40:39Resources and closing
related talks
49mIR: Optimizing Communications and Action Between Legal and Tech Leaders
40mIncident Response – How to Give the Advantage to the Hackers!
28mBeyond Incident Reporting - An Analysis of Structured Representations for Incident Response
29mBuilding a Product Security Incident Response Team: Learnings From the Hivemind
51mReal World Stories of Incident Response and Threat Intelligence
36mFrom Dork to Diplomat: Communicating Coherently for Vulnerability & Incident Response
29mMake It Fixable: Preparing for Security Vulnerability Reports
23mEnforcing Your Code of Conduct: Effective Incident Response