SANS - Lessons Learned

This playbook assists in post-processing an incident and facilitates the lessons learned stage, as presented by SANS Institute ‘Incident Handler’s Handbook’ by Patrick Kral. https://www.sans.org/reading-room/whitepapers/incident/incident-handlers-handbook-33901 ***Disclaimer: This playbook does not ensure compliance to SANS regulations.

SANS · 6 tasks · 2 inputs · 8 outputs

Inputs

  • DataCollection — Use a data collection task to answer lessons learned questions based on SANS. Specify 'True' to automatically send the communication task, and 'False' to prevent it.
  • Email — Email address to which to send the questions.

Outputs

  • SANS - Lessons Learned.Answers.0 — When was the problem was first detected and by whom?
  • SANS - Lessons Learned.Answers.1 — What was the scope of the incident?
  • SANS - Lessons Learned.Answers.2 — How was the incident contained and eradicated?
  • SANS - Lessons Learned.Answers.3 — What was the work performed during recovery?
  • SANS - Lessons Learned.Answers.4 — What were the areas where the CIRT teams were effective?
  • SANS - Lessons Learned.Answers.5 — What are the areas that need improvement?
  • SANS - Lessons Learned.Answers.6 — Share ideas and information in order to improve team effectiveness in future incidents.
  • SANS - Lessons Learned.Answers.name — Answered username or email address

Flowchart

yes Start Start Send data collection task? Send data collection task? Lessons Learned - Data Collection Lessons Learned - Data Co... Hold a “lessons learned” meeting with all involved parties Hold a “lessons learned” ... Done Done Lessons Learned Lessons Learned