In this part of the lab, you will document the findings of your investigation in an incident response report. For this purpose, you will reference a sample Incident Reporting Template developed by Carnegie Mellon University for the United States Computer Emergency Readiness Team (US-CERT).

https://www.cisa.gov/sites/default/files/c3vp/crr_resources_guides/CRR_Resource_Guide-IM.pdf

Giggly Goofo Game Studios Incident Response Team - Incident Reporting Template Date Insert current date here. Name Insert your name here. Incident Priority Define this incident as High, Medium, Low, or Other. Incident Type Include all that apply: Compromised System, Compromised User Credentials, Network Attack (e.g., DoS), Malware (e.g. virus, worm, trojan), Reconnaissance (e.g. scanning, sniffing), Lost Equipment/Theft, Physical Break-in, Social Engineering, Law Enforcement Request, Policy Violation, Unknown/Other.Incident Timeline Define the following: Date and time when the incident was discovered, Date and time when the incident was reported, and Date and time when the incident occurred, as well as any other relevant timeline details. Incident Scope Define the following: Estimated quantity of systems affected, estimated quantity of users affected, third parties involved or affected, as well as any other relevant scoping information. Systems Affected by the Incident Define the following: Attack sources (e.g., IP address, port), attack destinations (e.g., IP address, port), IP addresses of the affected systems, primary functions of the affected systems (e.g., web server, domain controller). Users Affected by the Incident Define the following: Names and job titles of the affected users