<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 -->
<!-- NERF is a trademark of defconxt. -->
---
name: conducting-post-incident-review
description: >-
  Conducts structured post-incident reviews including timeline reconstruction,
  root cause analysis, detection gap identification, lessons learned documentation,
  and actionable improvement tracking using after-action report frameworks.
domain: cybersecurity
subdomain: incident-response
tags:
  - post-incident-review
  - after-action-report
  - lessons-learned
  - root-cause-analysis
  - detection-gaps
  - process-improvement
version: '1.0'
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1003.001", "T1003.006", "T1021.002", "T1059.001", "T1071.001", "T1566.001"]
---

# Conducting Post-Incident Review

## Overview

The post-incident review (PIR) transforms incident pain into organizational
improvement. A blameless, structured review identifies detection gaps, process
failures, and architectural weaknesses that enabled the incident. Without PIR,
organizations repeat the same failures. This skill covers after-action report
structure, root cause analysis techniques (5 Whys, fishbone), detection gap
mapping to ATT&CK, and improvement tracking.

PIR should happen within 5 business days of incident closure while details are
fresh. All participants — IR team, SOC, IT operations, management — contribute.

## Prerequisites

| Tool | Purpose | Install |
|------|---------|---------|
| ATT&CK Navigator | Detection coverage mapping | https://mitre-attack.github.io/attack-navigator/ |
| Confluence / Wiki | Documentation platform | Existing deployment |
| Jira / Linear | Improvement action tracking | Existing deployment |
| Timeline tool | Incident timeline visualization | Plaso / custom |

## Key Concepts

### After-Action Report Structure

```
1. Executive Summary (1 page)
2. Incident Timeline (detailed, UTC-normalized)
3. Root Cause Analysis
4. Detection Analysis (what worked, what missed)
5. Response Effectiveness Assessment
6. Lessons Learned (categorized)
7. Improvement Actions (with owners and deadlines)
8. ATT&CK Coverage Gap Analysis
9. Appendices (IOCs, evidence inventory, communications log)
```

### Root Cause Analysis Methods

| Method | Best For |
|--------|----------|
| 5 Whys | Simple causal chains |
| Fishbone (Ishikawa) | Multi-factor root causes |
| Fault Tree Analysis | Complex system failures |
| Timeline Analysis | Understanding attack progression |

### Detection Gap Categories

| Category | Example |
|----------|---------|
| No telemetry | No Sysmon, no PowerShell logging |
| Telemetry exists, no rule | Logs available but no detection written |
| Rule exists, not tuned | Detection fires but buried in noise |
| Rule exists, evaded | Attacker bypassed detection logic |
| Alert fatigue | Analyst missed valid alert |

## Workflow

### Step 1 — Reconstruct Incident Timeline

```
INCIDENT TIMELINE — INC-2026-0342
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
2026-03-10 02:14 UTC — Initial phishing email delivered to user@company.com
2026-03-10 09:32 UTC — User clicks link, downloads macro-enabled document
2026-03-10 09:33 UTC — Macro executes PowerShell stager (T1059.001)
2026-03-10 09:35 UTC — C2 beacon established to 198.51.100.42 (T1071.001)
2026-03-10 10:15 UTC — Credential dumping via Mimikatz (T1003.001)
2026-03-10 11:30 UTC — Lateral movement to DC01 via PsExec (T1021.002)
2026-03-10 12:00 UTC — DCSync attack — all domain hashes extracted (T1003.006)
2026-03-15 08:00 UTC — EDR alert triggers on DC01 anomalous process
2026-03-15 08:15 UTC — SOC analyst acknowledges alert, begins triage
2026-03-15 09:00 UTC — IR team activated, containment initiated
2026-03-15 10:30 UTC — All compromised hosts isolated
2026-03-17 16:00 UTC — Eradication complete, recovery initiated

DWELL TIME: 5 days, 5 hours, 46 minutes
DETECTION TRIGGER: EDR behavioral detection on DC01
```

### Step 2 — Perform Root Cause Analysis

```
5 WHYS ANALYSIS
━━━━━━━━━━━━━━
WHY 1: Domain admin credentials were compromised
  ↳ WHY 2: Attacker performed DCSync from compromised workstation
    ↳ WHY 3: Workstation user had local admin + network access to DC
      ↳ WHY 4: No network segmentation between workstations and DCs
        ↳ WHY 5: Segmentation project deprioritized in Q3 planning

ROOT CAUSE: Insufficient network segmentation + excessive workstation privileges
CONTRIBUTING FACTORS:
- No MFA on VPN (initial access)
- Macro execution allowed in Office (execution)
- No PowerShell Constrained Language Mode (defense evasion)
- Sysmon not deployed on workstations (detection gap)
```

### Step 3 — Map Detection Gaps to ATT&CK

```
ATT&CK DETECTION GAP ANALYSIS
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
| TTP | Technique | Detection Status | Gap |
|-----|-----------|-----------------|-----|
| T1566.001 | Phishing Attachment | MISSED | Email gateway passed macro doc |
| T1059.001 | PowerShell | MISSED | No script block logging enabled |
| T1071.001 | Web C2 | MISSED | No SSL inspection, IP not blocklisted |
| T1003.001 | LSASS Dump | MISSED | No Sysmon on workstation |
| T1021.002 | SMB/PsExec | MISSED | No lateral movement detection rule |
| T1003.006 | DCSync | DETECTED | EDR behavioral rule on DC01 |
```

### Step 4 — Document Lessons Learned

```
LESSONS LEARNED
━━━━━━━━━━━━━━
DETECTION:
- Sysmon deployment coverage was 40% — must reach 95% within 60 days
- PowerShell script block logging not enabled enterprise-wide
- No Sigma rules for PsExec lateral movement pattern

PROCESS:
- Initial triage took 45 minutes (SLA: 15 minutes for P1)
- Memory acquisition delayed by 2 hours due to tooling gaps
- Communication to CISO delayed — escalation matrix unclear

ARCHITECTURE:
- Workstation-to-DC traffic unrestricted
- Local admin rights too broadly granted
- No MFA on internal RDP sessions
```

### Step 5 — Create Improvement Action Items

```bash
# Generate tracked improvement actions
cat <<'EOF'
ACTION ITEMS — INC-2026-0342 PIR
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
| # | Action | Owner | Deadline | Priority |
|---|--------|-------|----------|----------|
| 1 | Deploy Sysmon to 95% of endpoints | IT Ops | 2026-04-15 | P1 |
| 2 | Enable PowerShell script block logging | IT Ops | 2026-03-31 | P1 |
| 3 | Implement workstation-DC segmentation | Network | 2026-05-01 | P1 |
| 4 | Write Sigma rules for PsExec/WMI lateral movement | Detection Eng | 2026-04-01 | P2 |
| 5 | Deploy MFA on all RDP sessions | IAM | 2026-04-15 | P2 |
| 6 | Remove local admin from standard users | IT Ops | 2026-04-30 | P2 |
| 7 | Update escalation matrix and test with tabletop | IR Lead | 2026-04-01 | P3 |
| 8 | Pre-stage memory acquisition tools on all servers | IR Team | 2026-03-25 | P3 |
EOF
```

## Detection

```yaml
title: Post Incident Review Detection
id: 37d9a3c9-898d-4294-a862-2dbe401b9c95
status: experimental
description: Detects suspicious activity related to conducting post incident review techniques in incident response context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*conducting*post*"
  condition: selection
level: high
tags:
  - attack.t1003.001
  - attack.t1003.006
  - attack.t1021.002
  - attack.t1059.001
  - attack.t1071.001
  - attack.t1566.001
  - attack.impact
falsepositives:
  - Incident response team running authorized forensic collection tools
```

## Verification

- [ ] Complete incident timeline reconstructed with UTC timestamps
- [ ] Root cause analysis completed using structured method
- [ ] All ATT&CK techniques mapped with detection status
- [ ] Detection gaps categorized and prioritized
- [ ] Process failures documented with corrective actions
- [ ] Improvement actions created with owners and deadlines
- [ ] After-action report distributed to all stakeholders
- [ ] Follow-up review scheduled to verify action completion

## References

- NIST SP 800-61r3: Section 3.4 — Post-Incident Activity
- SANS Lessons Learned Framework
- MITRE ATT&CK Navigator: https://mitre-attack.github.io/attack-navigator/
- Etsy Debriefing Facilitation Guide (blameless postmortems)
- Google SRE Book: Chapter 15 — Postmortem Culture
