incident-response-dfir

Acquire and preserve digital evidence so it survives scrutiny — collect in RFC 3227 order of volatility (most-volatile first), hash at collection, maintain an unbroken chain of custody, and use the right acquisition method per source (memory, disk, network, cloud). Returns the acquisition plan, the chain-of-custody log, and the hash/verification record. Used by `detection-and-forensics-engineer` (primary); enforced as a gate by `dfir-response-lead` before remediation.

Turn an observed (or hypothesized) adversary behavior into a durable detection — author a Sigma/SIEM rule, map it to the MITRE ATT&CK technique it covers, and ship a false-positive tuning plan so the rule survives contact with production logs instead of dying in alert fatigue. Returns the rule, its ATT&CK mapping, test cases, and the tuning/allow-list plan. Used by `detection-and-forensics-engineer` (primary).

Run a hypothesis-driven threat hunt — turn a testable claim about adversary activity into named data sources and queries, guided by MITRE ATT&CK, and rank findings up David Bianco's pyramid of pain so effort goes at TTPs (expensive for the adversary to change) rather than hashes and IPs (trivial to change). Returns the hypothesis, the data sources + queries, findings, and any detections/incidents to spin up. Used by `detection-and-forensics-engineer` (primary).

Run a security incident through the four-phase incident-handling lifecycle in order — preparation, detection & analysis, containment/eradication/recovery, and post-incident activity — with the contain-before-eradicate and preserve-evidence-first gates enforced at the right steps. Returns a phase-by-phase runbook, the containment strategy, the recovery/eradication plan, and a blameless post-incident review. Used by `dfir-response-lead` (primary); shared with the forensics engineer at the analysis seam.

Decide whether an alert or report is a genuine security incident (the is-it-an-incident gate), then classify its severity/priority from a business-impact × scope matrix so the response tier is set by impact, not by how loud the alert looks. Returns the incident verdict, the severity level + the rule that picked it, and the response tier it triggers. Used by `dfir-response-lead` (primary).