aegis-incident-response-lifecycle
Incident-Response Lifecycle (IR)
Adaptation Note — Read First
This module deviates from the red-team template on purpose. It is not vulnerability hunting; it is the orchestration layer that runs WHEN a finding is exploited or an audit gap is hit in production. Section meanings are remapped as follows:
| Template section | Meaning HERE |
|---|---|
| What To Check | Readiness-audit items: does IR capability exist at all? |
| Where To Look | Where artifacts/docs/tools should live if capability exists |
| Patterns & Signatures | Playbook templates, checklists, scenario tables (the bulk) |
| Taint Tracing Guidance | Escalation/communication chains: who informs whom, when |
| Exploitation & Reproduction | Tabletop exercise procedures (simulated, explicitly non-destructive) |
| Severity Assessment | Incident-severity matrix SEV1–SEV4, NOT vulnerability CVSS |
Empty cwe array is intentional: this module audits process capability, not a code-level weakness class. Cross-references assume sibling modules by slug: TOK (skills/server/api-token-security/SKILL.md), SUPPLY (skills/code/supply-chain/SKILL.md), DR (skills/server/backup-dr/SKILL.md), LOGMON (skills/server/logging-monitoring/SKILL.md), DETECT (skills/operations/blue-team-detection/SKILL.md). The host-forensics deep-dive (DFIR) is a planned companion; until it exists in your copy, treat this module's evidence-preservation steps plus the sweep scripts under tools/sweeps/ as authoritative for triage-time forensics.