SANS - Lessons Learned

id: SANS - Lessons Learned
version: -1
fromversion: 5.0.0
name: SANS - Lessons Learned
description: |-
  This playbook assists in post-processing an incident and facilitates the lessons learned stage, as presented by SANS Institute ‘Incident Handler’s Handbook’ by Patrick Kral.

  https://www.sans.org/reading-room/whitepapers/incident/incident-handlers-handbook-33901

  ***Disclaimer: This playbook does not ensure compliance to SANS regulations.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 3615bd0a-9d41-4631-8b9d-e59f5bf49df6
    type: start
    task:
      id: 3615bd0a-9d41-4631-8b9d-e59f5bf49df6
      version: -1
      name: ""
      description: ""
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "5"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "1":
    id: "1"
    taskid: 746f24a7-16d6-4c97-8ec3-7ec9bfdce6c1
    type: condition
    task:
      id: 746f24a7-16d6-4c97-8ec3-7ec9bfdce6c1
      version: -1
      name: Send data collection task?
      description: ""
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "3"
      "yes":
      - "2"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.DataCollection
                transformers:
                - operator: toLowerCase
            iscontext: true
          right:
            value:
              simple: "true"
    view: |-
      {
        "position": {
          "x": 265,
          "y": 340
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "2":
    id: "2"
    taskid: 746753a7-3e97-45aa-8ef2-8ee5561a766b
    type: collection
    task:
      id: 746753a7-3e97-45aa-8ef2-8ee5561a766b
      version: -1
      name: Lessons Learned - Data Collection
      description: ""
      type: collection
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 515
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    message:
      to:
        complex:
          root: inputs.Email
      subject:
        simple: Please answer the attached survey questions as a part of your lessons
          learned activity.
      body: null
      methods:
      - email
      format: ""
      bcc: null
      cc: null
      timings:
        retriescount: 2
        retriesinterval: 360
        completeafterreplies: 1
    form:
      questions:
      - id: "0"
        label: ""
        labelarg:
          simple: When was the problem was first detected and by whom?
        required: false
        gridcolumns: []
        defaultrows: []
        type: longText
        options: []
        fieldassociated: ""
        placeholder: ""
        tooltip: ""
        readonly: false
      - id: "1"
        label: ""
        labelarg:
          simple: What was the scope of the incident?
        required: false
        gridcolumns: []
        defaultrows: []
        type: longText
        options: []
        fieldassociated: ""
        placeholder: ""
        tooltip: ""
        readonly: false
      - id: "2"
        label: ""
        labelarg:
          simple: How was the incident contained and eradicated?
        required: false
        gridcolumns: []
        defaultrows: []
        type: longText
        options: []
        fieldassociated: ""
        placeholder: ""
        tooltip: ""
        readonly: false
      - id: "3"
        label: ""
        labelarg:
          simple: What was the work performed during recovery?
        required: false
        gridcolumns: []
        defaultrows: []
        type: longText
        options: []
        fieldassociated: ""
        placeholder: ""
        tooltip: ""
        readonly: false
      - id: "4"
        label: ""
        labelarg:
          simple: What were the areas where the CIRT teams were effective?
        required: false
        gridcolumns: []
        defaultrows: []
        type: longText
        options: []
        fieldassociated: ""
        placeholder: ""
        tooltip: ""
        readonly: false
      - id: "5"
        label: ""
        labelarg:
          simple: What are the areas that need improvement?
        required: false
        gridcolumns: []
        defaultrows: []
        type: longText
        options: []
        fieldassociated: ""
        placeholder: ""
        tooltip: ""
        readonly: false
      - id: "6"
        label: ""
        labelarg:
          simple: |-
            Suggestions and discussion between members of how to improve
            the overall team:
        required: false
        gridcolumns: []
        defaultrows: []
        type: longText
        options: []
        fieldassociated: ""
        placeholder: ""
        tooltip: Share ideas and information in order to improve team effectiveness
          in future incidents.
        readonly: false
      title: SANS - Lessons Learned
      description: |-
        “The purpose of this phase is to complete any documentation that was not done during the incident, as well as any additional documentation that may be beneficial in future incidents.
        The document should also be written in a form of a report to provide a play-by-play review of the entire incident; this report should be able to answer the: Who, What, Where, Why, and How questions that may come up during the lessons learned meeting.
        The overall goal is to learn from the incidents that occurred within an organization to improve the team’s performance and provide reference materials in the event of a
        similar incident.
        The lessons learned meeting should be performed as soon as possible”
      sender: ""
      expired: false
      totalanswers: 0
  "3":
    id: "3"
    taskid: d2adb221-3709-4e5a-85d7-134c09a07afe
    type: regular
    task:
      id: d2adb221-3709-4e5a-85d7-134c09a07afe
      version: -1
      name: Hold a “lessons learned” meeting with all involved parties
      description: |-
        1) Review the incident response process of the incident that had occurred with all
        CIRT members.

        2) Discuss any mistake or areas where the response process could have been handled better.
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "4"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 685
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "4":
    id: "4"
    taskid: 9f23d64b-71c4-4383-8fd9-944a4abb5d60
    type: title
    task:
      id: 9f23d64b-71c4-4383-8fd9-944a4abb5d60
      version: -1
      name: Done
      description: ""
      type: title
      iscommand: false
      brand: ""
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 860
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "5":
    id: "5"
    taskid: 9c82bb6d-6a40-444f-8c9b-74754e951268
    type: title
    task:
      id: 9c82bb6d-6a40-444f-8c9b-74754e951268
      version: -1
      name: Lessons Learned
      description: ""
      type: title
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "1"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 875,
        "width": 595,
        "x": 50,
        "y": 50
      }
    }
  }
inputs:
- key: DataCollection
  value: {}
  required: false
  description: Use a data collection task to answer lessons learned questions based
    on SANS. Specify 'True' to automatically send the communication task, and 'False'  to
    prevent it.
- key: Email
  value: {}
  required: false
  description: Email address to which to send the questions.
outputs:
- contextPath: SANS - Lessons Learned.Answers.0
  description: When was the problem was first detected and by whom?
  type: longText
- contextPath: SANS - Lessons Learned.Answers.1
  description: What was the scope of the incident?
  type: longText
- contextPath: SANS - Lessons Learned.Answers.2
  description: How was the incident contained and eradicated?
  type: longText
- contextPath: SANS - Lessons Learned.Answers.3
  description: What was the work performed during recovery?
  type: longText
- contextPath: SANS - Lessons Learned.Answers.4
  description: What were the areas where the CIRT teams were effective?
  type: longText
- contextPath: SANS - Lessons Learned.Answers.5
  description: What are the areas that need improvement?
  type: longText
- contextPath: SANS - Lessons Learned.Answers.6
  description: Share ideas and information in order to improve team effectiveness
    in future incidents.
  type: longText
- contextPath: SANS - Lessons Learned.Answers.name
  description: Answered username or email address
tests:
  - No test