🔐 Security Kit — Incident Response Kit Demo

• Playbook generator — step-by-step response plans for data breaches, DDoS, ransomware, phishing, and more
• Communication templates — pre-written drafts for stakeholders, customers, and technical teams
• Timeline builder — build chronological incident timelines from event JSON
• Severity classifier — classify incidents as P1-P4 with SLA targets and escalation rules
• Role assignments — suggested team roles for each incident type (IC, comms lead, technical lead)
• Response workflows — checklists for containment, eradication, recovery, and lessons learned

# Generate a data breach response playbook
python src/incident_response_kit.py --mode playbook --type data-breach

# Build a timeline from events
python src/incident_response_kit.py --mode timeline --events examples/sample_events.json

# Generate a stakeholder communication template
python src/incident_response_kit.py --mode template --type stakeholder

# Classify an incident by description
python src/incident_response_kit.py --mode classify --description "Database accessible without auth"

{
    "incident_id": "INC-2026-042",
    "incident_type": "data-breach",
    "severity": "P1",
    "events": [
        {
            "timestamp": "2026-03-14T08:00:00Z",
            "description": "Anomalous database query volume detected",
            "actor": "monitoring-system"
        },
        {
            "timestamp": "2026-03-14T08:15:00Z",
            "description": "SOC analyst confirms unauthorized access",
            "actor": "security-team"
        }
    ]
}