Conducting Post-Incident Lessons Learned（开展事件后经验教训总结）
When to Use
- 任何安全事件已完全解决且恢复工作已完成之后
- 在开展红蓝桌面演练（tabletop exercises）或 IR 模拟演练之后
- 在发生重大险情事件（near-miss）之后
- 季度性复盘累积的事件趋势
- 当需要根据真实事件经验更新 IR playbook 时
Prerequisites
- 事件已完全解决（遏制、消除、恢复均已完成）
- 已收集事件时间线与相关文档
- 所有事件响应人员可参与复盘会议
- 已准备好用于协作讨论的会议空间
- 已具备事件工单系统数据用于指标分析
Workflow
Step 1: Gather Incident Data
# Export incident timeline from ticketing system
curl -s "https://thehive.local/api/v1/case/$CASE_ID/timeline" \
-H "Authorization: Bearer $THEHIVE_API_KEY" | jq '.' > incident_timeline.json
# Extract detection and response metrics from SIEM
index=notable incident_id="IR-2024-042"
| stats min(_time) as first_alert, max(_time) as last_alert,
count as total_alerts, dc(src) as unique_sources
# Compile all responder actions and timestamps
grep -E "timestamp|action|analyst" /var/log/ir/IR-2024-042/*.json | \
python3 -m json.tool > compiled_actions.json
Step 2: Conduct Blameless Post-Mortem Meeting
Structured Agenda (90 minutes):
1. Incident summary (5 min) - Factual overview
2. Timeline walkthrough (20 min) - Chronological events
3. What worked well (15 min) - Positive outcomes
4. What needs imp…
