Physical & Digital Security Controls

LakeTown Digital Fortress: Incident Response (IR) Playbook v2.0

1. Preparation

1.1 Asset Inventory

• Maintain updated documentation for all virtual and physical hosts.
  
  

• Include: Hostnames, IPs, MACs, Operating Systems, Roles (e.g., AD Server, Kali Attack Box, Ubuntu SIEM Agent).
  
  

1.2 Monitoring Baseline

• Wazuh: Define thresholds for FIM, logins, and system modifications.
  
  

• Splunk: Establish dashboards for CPU usage, login failures, service starts, and user behavior.
  
  

• Confirm logging sources from all agents (Linux/Windows).
  
  

1.3 Vulnerability Management

• Use Nessus Essentials weekly for vulnerability scans.
  
  

• Track vulnerabilities using CVSS scores and tag critical assets.
  
  

2. Detection & Analysis

2.1 Threat Detection

• Wazuh Alerts: Monitor for unauthorized login attempts, changes to sensitive files, abnormal process activity.
  
  

• Splunk Dashboards: Monitor trends and correlate data across hosts.
  
  

• Wireshark: Capture traffic during incidents, flag suspicious protocols (e.g., FTP, SMBv1).
  
  

2.2 Event Classification

• Category A: Unauthorized Access (brute force, credential abuse)
  
  

• Category B: Malware Infection (unexpected file writes, new processes)
  
  

• Category C: Network Intrusion (rogue APs, Nmap scans)
  
  

2.3 Indicators of Compromise (IoCs)

• Hashes of suspicious files
  
  

• IPs from blacklists
  
  

• Anomalous login times/locations
  
  

3. Containment, Eradication, and Recovery

3.1 Containment Procedures

• Isolate affected VM using pfSense VLANs.
  
  

• Disable compromised accounts.
  
  

• Block offending IPs in firewall rules.
  
  

3.2 Eradication

• Remove malicious files/processes manually.
  
  

• Patch identified vulnerabilities from Nessus reports.
  
  

• Disable or harden exposed services (SSH, RDP, SMB).
  
  

3.3 Recovery

• Restore from clean backups if needed.
  
  

• Re-enable services one at a time while monitoring.
  
  

• Conduct Nessus re-scan to confirm remediation.
  
  

4. Post-Incident Activity (Lessons Learned)

4.1 Documentation

• Incident timeline
  
  

• Logs and screenshots from Wazuh, Splunk, Nessus, Wireshark
  
  

• Attack vector and response summary
  
  

4.2 IR Playbook Update

• Adjust detection thresholds in Wazuh.
  
  

• Refine Splunk queries for better correlation.
  
  

• Add new containment methods based on incident.
  
  

4.3 Team Review

• Conduct tabletop exercise on the incident.
  
  

• Discuss what worked, what didn’t, and gaps in visibility or response.
  
  

Appendix

• Diagram: Network layout with pfSense zones
  
  

• Tool Config References: Wazuh rules, Splunk dashboards, pfSense firewall rules
  
  

• Log Sources: List of all logs ingested into Splunk/Wazuh
  
  

• Backup Plan: Weekly backup schedule and recovery test checklist
  
  

Document owner: LakeyneshiaTownsend HSOC IR Lead
Last updated: [11/3/2025]