SANS - Lessons Learned

This playbook assists in post-processing an incident and facilitates the lessons learned stage, as presented by SANS Institute ‘Incident Handler’s Handbook’ by Patrick Kral. https://www.sans.org/reading-room/whitepapers/incident/incident-handlers-handbook-33901 ***Disclaimer: This playbook does not ensure compliance to SANS regulations.

Pack

SANS

Tasks

6

Inputs

• DataCollection — Use a data collection task to answer lessons learned questions based on SANS. Specify 'True' to automatically send the communication task, and 'False' to prevent it.
• Email — Email address to which to send the questions.

Outputs

• SANS - Lessons Learned.Answers.0 — When was the problem was first detected and by whom?
• SANS - Lessons Learned.Answers.1 — What was the scope of the incident?
• SANS - Lessons Learned.Answers.2 — How was the incident contained and eradicated?
• SANS - Lessons Learned.Answers.3 — What was the work performed during recovery?
• SANS - Lessons Learned.Answers.4 — What were the areas where the CIRT teams were effective?
• SANS - Lessons Learned.Answers.5 — What are the areas that need improvement?
• SANS - Lessons Learned.Answers.6 — Share ideas and information in order to improve team effectiveness in future incidents.
• SANS - Lessons Learned.Answers.name — Answered username or email address