<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: automating-incident-response-actions
description: >-
  Automate incident response actions including host isolation, evidence collection,
  IOC extraction, process enumeration, network connection analysis, and forensic
  artifact preservation using Python and system utilities.
domain: cybersecurity
subdomain: automation-scripting
tags:
  - incident-response
  - forensics
  - containment
  - evidence-collection
  - ioc
  - triage
  - dfir
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: []
---

# Automating Incident Response Actions

## Overview

Incident response automation reduces MTTR by scripting common triage, containment,
and evidence collection actions. This skill covers building Python tools that
enumerate processes, capture network connections, extract IOCs, collect volatile
evidence, and execute containment actions with audit logging.

Mode: `[MODE: INCIDENT]` — Automated triage and containment.

## Prerequisites

| Requirement | Details |
|---|---|
| Python 3.10+ with `psutil` (`pip install psutil`) | Required |
| Root/sudo access for full process and network visibility | Required |
| Linux target systems (adapts to macOS/Windows with psutil) | Required |
| Forensic image tools | `dd`, `volatility3` (optional) |

## Key Concepts

### Process Enumeration

```python
import psutil

def enumerate_processes() -> list[dict]:
    """List all running processes with security-relevant details."""
    procs = []
    for proc in psutil.process_iter(['pid', 'name', 'username', 'cmdline', 'connections', 'create_time']):
        try:
            info = proc.info
            info['connections'] = [
                {"local": f"{c.laddr.ip}:{c.laddr.port}", "remote": f"{c.raddr.ip}:{c.raddr.port}" if c.raddr else "", "status": c.status}
                for c in (info.get('connections') or [])
            ]
            procs.append(info)
        except (psutil.NoSuchProcess, psutil.AccessDenied):
            pass
    return procs
```

### Network Connection Snapshot

```python
def active_connections() -> list[dict]:
    """Capture all active network connections."""
    conns = []
    for c in psutil.net_connections(kind='inet'):
        conns.append({
            "local_addr": f"{c.laddr.ip}:{c.laddr.port}" if c.laddr else "",
            "remote_addr": f"{c.raddr.ip}:{c.raddr.port}" if c.raddr else "",
            "status": c.status,
            "pid": c.pid,
        })
    return conns
```

### Evidence Collection

```bash
# Volatile evidence (collect BEFORE containment)
date -u > /tmp/evidence/timestamp.txt
ps auxf > /tmp/evidence/processes.txt
ss -tulnp > /tmp/evidence/network.txt
last -a > /tmp/evidence/logins.txt
cat /proc/net/tcp > /tmp/evidence/proc_net_tcp.txt
ip addr show > /tmp/evidence/network_config.txt
iptables -L -n -v > /tmp/evidence/firewall.txt
```

## Workflow

### Step 1: Triage — Enumerate Processes

```bash
node scripts/agent.js --action processes --output /tmp/ir/processes.json
```

### Step 2: Capture Network Connections

```bash
node scripts/agent.js --action connections --output /tmp/ir/connections.json
```

### Step 3: Collect Volatile Evidence

```bash
node scripts/agent.js --action collect-evidence --evidence-dir /tmp/ir/evidence/
```

### Step 4: Extract IOCs

```bash
node scripts/agent.js --action extract-iocs --evidence-dir /tmp/ir/evidence/
```

## Verification

- [ ] Process enumeration captures PID, user, command line, connections
- [ ] Network snapshot identifies all established connections with PIDs
- [ ] Evidence collection preserves volatile data before containment
- [ ] IOC extraction identifies suspicious IPs, domains, hashes
- [ ] All actions are audit-logged with timestamps

## References

- [NIST SP 800-61 — Incident Handling Guide](https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final)
- [SANS Incident Response Process](https://www.sans.org/white-papers/33901/)
- [psutil Documentation](https://psutil.readthedocs.io/)
- [MITRE ATT&CK — Lateral Movement](https://attack.mitre.org/tactics/TA0008/)
