diff --git a/contributing/templates/operational-article.md b/contributing/templates/operational-article.md index b434882..b5e13a6 100644 --- a/contributing/templates/operational-article.md +++ b/contributing/templates/operational-article.md @@ -1,12 +1,10 @@ # [Investigation or Procedure Title] -**Purpose:** What problem does this page solve? -**Audience:** Analyst level and specialist roles. -**Environment:** Product/OS and minimum versions where known. -**Required telemetry:** Specific source tables or logs. -**Permissions:** Read permissions versus state-changing roles. -**Review date:** YYYY-MM-DD. -**Validation:** Concept / unvalidated until tested. +Explain in one sentence what the reader will investigate or accomplish. + +**Environment:** [Relevant products, operating systems or telemetry] +**Validation:** [Actual test status, such as Queries require local testing] +**Reviewed:** [YYYY-MM-DD] ## Before you begin diff --git a/defensive-security/dfir/end-to-end-playbooks/credential-theft.md b/defensive-security/dfir/end-to-end-playbooks/credential-theft.md index d781e3c..00860c9 100644 --- a/defensive-security/dfir/end-to-end-playbooks/credential-theft.md +++ b/defensive-security/dfir/end-to-end-playbooks/credential-theft.md @@ -1,11 +1,12 @@ -# Credential Theft: Operational Incident Investigation Playbook +# Credential Theft -**Operational status:** Practitioner workflow; KQL syntax and outcomes require testing against your deployed product schema. Not production-validated. -**Review:** 20 October 2026 · **Owner:** SOC/CSIRT · **Authorisation:** Follow local incident command, privacy and evidence procedures. +Investigate suspected credential or session compromise, trace resulting access and identify persistence. -> **Important:** Queries below are *investigation pivots*, not finished alerts. Microsoft Defender XDR Advanced Hunting and Microsoft Sentinel Log Analytics use different tables and schema. Execute each query only in its stated environment. Preserve evidence, record approvals and do not delay urgent containment when harm is ongoing. +**Environment:** Microsoft Sentinel, Microsoft Entra ID and Microsoft Defender XDR +**Validation:** Investigation queries require local testing +**Reviewed:** 20 October 2026 -## 1. Activate, assess and preserve +## 1. Before you begin 1. Create an incident record with UTC start/end, reporting source, owner, severity and affected business services. 2. Confirm the alert is based on real telemetry; capture original record IDs, device/user identifiers and time bounds. diff --git a/defensive-security/dfir/end-to-end-playbooks/lateral-movement.md b/defensive-security/dfir/end-to-end-playbooks/lateral-movement.md index 922783d..978bc0a 100644 --- a/defensive-security/dfir/end-to-end-playbooks/lateral-movement.md +++ b/defensive-security/dfir/end-to-end-playbooks/lateral-movement.md @@ -1,11 +1,12 @@ -# Lateral Movement: Operational Incident Investigation Playbook +# Lateral Movement -**Operational status:** Practitioner workflow; KQL syntax and outcomes require testing against your deployed product schema. Not production-validated. -**Review:** 20 October 2026 · **Owner:** SOC/CSIRT · **Authorisation:** Follow local incident command, privacy and evidence procedures. +Trace suspicious access between Windows systems, establish whether remote execution occurred and assess the wider scope. -> **Important:** Queries below are *investigation pivots*, not finished alerts. Microsoft Defender XDR Advanced Hunting and Microsoft Sentinel Log Analytics use different tables and schema. Execute each query only in its stated environment. Preserve evidence, record approvals and do not delay urgent containment when harm is ongoing. +**Environment:** Microsoft Defender XDR, Windows Security logs and network telemetry +**Validation:** Investigation queries require local testing +**Reviewed:** 20 October 2026 -## 1. Activate, assess and preserve +## 1. Before you begin 1. Create an incident record with UTC start/end, reporting source, owner, severity and affected business services. 2. Confirm the alert is based on real telemetry; capture original record IDs, device/user identifiers and time bounds. diff --git a/defensive-security/dfir/end-to-end-playbooks/phishing-compromise.md b/defensive-security/dfir/end-to-end-playbooks/phishing-compromise.md index 2434b0e..878589b 100644 --- a/defensive-security/dfir/end-to-end-playbooks/phishing-compromise.md +++ b/defensive-security/dfir/end-to-end-playbooks/phishing-compromise.md @@ -1,11 +1,12 @@ -# Phishing Compromise: Operational Incident Investigation Playbook +# Phishing Compromise -**Operational status:** Practitioner workflow; KQL syntax and outcomes require testing against your deployed product schema. Not production-validated. -**Review:** 20 October 2026 · **Owner:** SOC/CSIRT · **Authorisation:** Follow local incident command, privacy and evidence procedures. +Investigate a suspected phishing incident, identify affected users and devices, and determine whether account or mailbox access was misused. -> **Important:** Queries below are *investigation pivots*, not finished alerts. Microsoft Defender XDR Advanced Hunting and Microsoft Sentinel Log Analytics use different tables and schema. Execute each query only in its stated environment. Preserve evidence, record approvals and do not delay urgent containment when harm is ongoing. +**Environment:** Microsoft Defender XDR, Defender for Office 365, Microsoft Entra ID +**Validation:** Investigation queries require local testing +**Reviewed:** 20 October 2026 -## 1. Activate, assess and preserve +## 1. Before you begin 1. Create an incident record with UTC start/end, reporting source, owner, severity and affected business services. 2. Confirm the alert is based on real telemetry; capture original record IDs, device/user identifiers and time bounds. diff --git a/defensive-security/dfir/end-to-end-playbooks/ransomware.md b/defensive-security/dfir/end-to-end-playbooks/ransomware.md index 2df1532..3e2f835 100644 --- a/defensive-security/dfir/end-to-end-playbooks/ransomware.md +++ b/defensive-security/dfir/end-to-end-playbooks/ransomware.md @@ -1,11 +1,12 @@ -# Ransomware: Operational Incident Investigation Playbook +# Ransomware -**Operational status:** Practitioner workflow; KQL syntax and outcomes require testing against your deployed product schema. Not production-validated. -**Review:** 20 October 2026 · **Owner:** SOC/CSIRT · **Authorisation:** Follow local incident command, privacy and evidence procedures. +Assess suspected ransomware activity, scope affected systems, coordinate containment and verify recovery. -> **Important:** Queries below are *investigation pivots*, not finished alerts. Microsoft Defender XDR Advanced Hunting and Microsoft Sentinel Log Analytics use different tables and schema. Execute each query only in its stated environment. Preserve evidence, record approvals and do not delay urgent containment when harm is ongoing. +**Environment:** Microsoft Defender XDR, Windows, Active Directory and backup telemetry +**Validation:** Investigation queries require local testing +**Reviewed:** 20 October 2026 -## 1. Activate, assess and preserve +## 1. Before you begin 1. Create an incident record with UTC start/end, reporting source, owner, severity and affected business services. 2. Confirm the alert is based on real telemetry; capture original record IDs, device/user identifiers and time bounds.