# Incident Response Report: {{engagement_name}}

**Type:** {{engagement_type}}
**Period:** {{start_date}} — {{end_date}}
**Status:** {{status}}
**Prepared by:** NERF

---

## 1. Incident Summary

**Incident ID:** {{incident_id}}
**Severity:** {{incident_severity}}
**Classification:** {{incident_classification}}

{{executive_summary}}

---

## 2. Timeline

| Time | Event | Source | Actor |
|------|-------|--------|-------|
{{#timeline_events}}
| {{time}} | {{event}} | {{source}} | {{actor}} |
{{/timeline_events}}

{{^timeline_events}}
{{timeline}}
{{/timeline_events}}

---

## 3. Indicators of Compromise

### Network Indicators
{{#iocs_network}}
| Type | Value | Context | First Seen |
|------|-------|---------|------------|
| {{type}} | {{value}} | {{context}} | {{first_seen}} |
{{/iocs_network}}

### Host Indicators
{{#iocs_host}}
| Type | Value | Context | First Seen |
|------|-------|---------|------------|
| {{type}} | {{value}} | {{context}} | {{first_seen}} |
{{/iocs_host}}

### Behavioral Indicators
{{#iocs_behavioral}}
- {{.}}
{{/iocs_behavioral}}

{{^iocs_network}}
IOC tracking was not recorded for this engagement.
{{/iocs_network}}

---

## 4. Containment Actions

{{#containment_actions}}
| Time | Action | Status | Performed By |
|------|--------|--------|-------------|
| {{time}} | {{action}} | {{status}} | {{performed_by}} |
{{/containment_actions}}

{{^containment_actions}}
Containment actions were not recorded for this engagement.
{{/containment_actions}}

---

## 5. Root Cause Analysis

{{root_cause}}

### Attack Vector
{{attack_vector}}

### Contributing Factors
{{#contributing_factors}}
- {{.}}
{{/contributing_factors}}

---

## 6. Impact Assessment

### Systems Affected
{{#systems_affected}}
- {{.}}
{{/systems_affected}}

### Data Impact
{{data_impact}}

### Business Impact
{{business_impact}}

---

## 7. Eradication & Recovery

### Eradication Steps
{{#eradication_steps}}
1. {{.}}
{{/eradication_steps}}

### Recovery Steps
{{#recovery_steps}}
1. {{.}}
{{/recovery_steps}}

### Verification
{{recovery_verification}}

---

## 8. Lessons Learned

### What Went Well
{{#lessons_well}}
- {{.}}
{{/lessons_well}}

### What Could Improve
{{#lessons_improve}}
- {{.}}
{{/lessons_improve}}

### Action Items

| Priority | Action | Owner | Due Date |
|----------|--------|-------|----------|
{{#action_items}}
| {{priority}} | {{action}} | {{owner}} | {{due_date}} |
{{/action_items}}

---

## 9. Findings

{{#findings}}
### [{{id}}] {{title}}

| Field | Value |
|-------|-------|
| **Severity** | {{severity}} |
| **CWE** | {{cwe}} |
| **ATT&CK** | {{attack}} |
| **Location** | {{location}} |

**Description:** {{description}}

**Evidence:** {{proof}}

**Remediation:** {{remediation}}

---
{{/findings}}

{{^findings}}
Detailed findings were not recorded separately for this incident.
{{/findings}}

## 10. Scope & Constraints

**Mission:** {{mission}}

**Targets:**

{{targets}}

**Constraints:**

{{constraints}}

---

*Report generated by NERF on {{end_date}}*
