incident response playbook generator — free browser tool | fatcousin

home

select incident type · context fields · structured ir checklist · containment eradication recovery · markdown or pdf export · runs locally

incident typeseverityorg size has IR team has EDR/SIEM

context

regulatory: HIPAA PCI-DSS SOX GDPR

playbook preview

# incident response playbook

- **type:** Ransomware
- **severity:** Critical
- **organization:** Enterprise
- **systems:** —
- **generated:** 2026-05-21T02:30:40.662Z

## chain of custody reminder
- hash all acquired evidence · log transfers · maintain signed custody forms

## Detection & Analysis
- [ ] [SOC] Confirm incident is real, not a false positive (15min) · NIST SP 800-61 §3.2
- [ ] [IR Lead] Document initial scope and affected assets (30min)
- [ ] [SOC] Pull EDR timeline for patient zero host (45min)
- [ ] [Forensics] Preserve volatile evidence (memory, net connections) (1h)

## Containment
- [ ] [IR Lead] Isolate affected hosts from network (VLAN/firewall) (30min)
- [ ] [IT Ops] Disable compromised accounts and reset creds (1h)
- [ ] [Legal/PR] Assess notification obligations (2h)

## Eradication
- [ ] [Forensics] Identify ransomware family and IOCs (4h)
- [ ] [IT Ops] Remove persistence (scheduled tasks, services) (4h)

## Recovery
- [ ] [IT Ops] Restore from clean backups; verify backup integrity first (variable)
- [ ] [IR Lead] Decrypt vs restore decision with leadership (variable)

## Post-Incident
- [ ] [IR Lead] Lessons learned: backup gaps, segmentation (1 week)
- [ ] [IR Lead] Update detection rules and playbooks (1 week)