Features

This chapter covers the core features and capabilities of Incident Response Kit.

Features

• Playbook generator — step-by-step response plans for data breaches, DDoS, ransomware, phishing, and more
• Communication templates — pre-written drafts for stakeholders, customers, and technical teams
• Timeline builder — build chronological incident timelines from event JSON
• Severity classifier — classify incidents as P1-P4 with SLA targets and escalation rules
• Role assignments — suggested team roles for each incident type (IC, comms lead, technical lead)
• Response workflows — checklists for containment, eradication, recovery, and lessons learned
• JSON and Markdown output — structured data or human-readable documents
• Customizable — adapt playbooks and templates to your organization's procedures

Requirements

• Python 3.10+
• No external dependencies (stdlib only)

Quick Start

Follow this guide to get Incident Response Kit up and running in your environment.

Quick Start

# Generate a data breach response playbook
python src/incident_response_kit.py --mode playbook --type data-breach

# Build a timeline from events
python src/incident_response_kit.py --mode timeline --events examples/sample_events.json

# Generate a stakeholder communication template
python src/incident_response_kit.py --mode template --type stakeholder

# Classify an incident by description
python src/incident_response_kit.py --mode classify --description "Database accessible without auth"

Output

Playbooks and templates output as Markdown documents ready to share. Timelines render as chronological event lists. The classifier returns a severity level with SLA targets and recommended actions.