vtino17/incident-response-playbooks
GitHub: vtino17/incident-response-playbooks
一套企业级事件响应框架，整合了标准响应流程、取证脚本、SIEM 查询库和报告模板，帮助安全运营团队快速规范化地处置各类安全事件。
Stars: 0 | Forks: 0
# 事件响应 Playbook
面向安全运营团队的企业级事件响应框架，包含 playbook、取证收集脚本、SIEM 查询库、证据管理模板和沟通模板。
## 结构
```
incident-response-playbooks/
playbooks/ Incident-specific response procedures
scripts/windows/ Windows forensics acquisition
scripts/linux/ Linux forensics acquisition
scripts/network/ Network evidence collection
forensics/ Analysis scripts and decoders
queries/splunk/ Splunk SPL detection queries
queries/elastic/ Elasticsearch EQL/KQL queries
queries/wazuh/ Wazuh decoder and rule XML
templates/reports/ Incident report templates
templates/communication/ Stakeholder notification templates
evidence/ Evidence handling procedures
docs/ Operational documentation
```
## 快速开始
```
git clone https://github.com/vtino17/incident-response-playbooks.git
cd incident-response-playbooks
# 针对勒索软件事件
cat playbooks/ransomware.md
# 收集 Windows 取证
sudo python scripts/windows/collect_evidence.ps1
# 查询 SIEM 以获取 IOC
cat queries/splunk/ioc_hunting.spl
```
## Playbook
- 勒索软件响应
- 钓鱼攻击调查
- 数据泄露遏制
- DDoS 缓解
- 内部威胁
- 恶意软件爆发
- 未经授权的访问
- 商业邮件入侵
## 许可证
MIT
标签：AI合规, Libemu, 逆向工具, 防御加固