20. Triage and Incident Response Scripts

This chapter synthesizes the book into authorized triage scripts, log review pipelines, host inventory, IOC-style checks, incident notes, and security reports.

• Triage: Collect the first facts quickly and carefully.

• Inventory: Record host state.

• Indicators: Search for known patterns.

• Notes: Document actions and uncertainty.

• Reports: Turn findings into useful handoff material.

Chapter Video

From Windows to Linux: Master Incident Response with SANS FOR577 (1:29) by SANS Digital Forensics and Incident Response

Hosted on YouTube; property of its original creator, embedded here for educational reference only.

Learning Objectives

By the end of this chapter, you will be able to:

1. Collect host triage facts without modifying evidence.

2. Build log review pipelines for selected indicators.

3. Create host inventory output.

4. Write incident notes with commands and timestamps.

5. Generate a final authorized triage report.

Chapter Flow

1. Host Triage

2. Log Review Pipelines

3. Indicators and Inventory

4. Incident Report

Glossary

#	Term	Explanation
1	triage	First-pass prioritization and fact collection.
2	incident	Security event requiring investigation.
3	indicator	Pattern or fact associated with suspicious activity.
4	IOC	Indicator of compromise.
5	inventory	Structured record of host facts.
6	timeline	Ordered list of events.
7	containment	Action to limit impact.
8	handoff	Transfer of findings to another person or team.
9	scope	Authorized boundary of work.
10	report	Final written summary.