Post-incident commands

Quick reference

Coverage

$python3 detection_gap.py t.json d.json
$grep -rl 'T1059' detection/
$jq '.[] | select(.enabled)' det.json
$git log -1 --format=%cs detection/

Runbooks

$python3 runbook_freshness.py docs/runbooks
$find docs/runbooks -name '*.md' -mtime +90
$grep -L '^Owner:' docs/runbooks/*.md
$git log -1 --format=%cs docs/runbooks/*.md

Alerts

$python3 alert_fatigue.py alerts.json
$jq '[.[]|select(.actioned)]|length'
$grep -c '"actioned": false' alerts.json
$python3 alert_fatigue.py a.json --days 30

Controls

$python3 control_verify.py ctl.json exports
$jq '.mfa.enforced' exports/iam.json
$aws iam get-account-summary
$terraform plan -detailed-exitcode

Explained

Coverage

detection_gap.py compares the technique list with the rules. The grep and jq lines find a technique and show which rules are enabled. git log tells you when the detection directory last changed.

Runbooks

runbook_freshness.py checks dates, owners and links. find checks the file's modification time and grep finds a missing owner line, which are proxies when the tool is not installed. The last line shows the last commit that touched the runbooks.

Alerts

alert_fatigue.py ranks rules by signal. The jq and grep lines count actioned and unactioned alerts in an export. --days 30 keeps the review to the current month.

Controls

control_verify.py joins the inventory with the exports. The jq line reads one key, the AWS CLI reads the account summary, and terraform plan -detailed-exitcode shows whether the infrastructure still matches the code.

The fix

Paste the sheet into the incident channel at the start of the review. Answer each question with one command, and write down the command that answered it.

Prevention

Keep the sheet beside the runbooks and update it when a postmortem finds a better command. A sheet nobody edits is a museum.

In one line

Run the sheet

$python3 detection_gap.py t.json d.json