Incident Handler’s Journal
Overview
A running journal used to record findings, tools and lessons learned from incident response activities.
First entry
A ransomware attack shut down a small U.S. primary-care clinic after a phishing email let attackers in. I documented the five W’s (who, what, when, where, why), the tools I’d expect to use (EDR, SIEM, network monitoring) and initial takeaways.
The deliverable
