Overview

A comprehensive Security Incident Response Playbook implementation in Java that automates incident handling, coordination, and remediation processes.

Core Incident Response Framework

1. Incident Management System

package com.example.security.incident; import org.springframework.stereotype.Service; import java.util.*; import java.util.concurrent.ConcurrentHashMap; import java.util.stream.Collectors; @Service public class IncidentManager { private final Map<String, SecurityIncident> activeIncidents = new ConcurrentHashMap<>(); private final Map<String, List<IncidentAction>> incidentActions = new ConcurrentHashMap<>(); private final IncidentNotifier notifier; private final IncidentRepository repository; public IncidentManager(IncidentNotifier notifier, IncidentRepository repository) { this.notifier = notifier; this.repository = repository; } public SecurityIncident createIncident(IncidentCreationRequest request) { SecurityIncident incident = new SecurityIncident(); incident.setId(generateIncidentId()); incident.setTitle(request.getTitle()); incident.setDescription(request.getDescription()); incident.setSeverity(request.getSeverity()); incident.setCategory(request.getCategory()); incident.setStatus(IncidentStatus.NEW); incident.setCreatedAt(new Date()); incident.setCreatedBy(request.getReporter()); incident.setLastUpdated(new Date()); // Apply incident classification classifyIncident(incident); // Store incident activeIncidents.put(incident.getId(), incident); repository.save(incident); // Trigger notifications notifier.notifyIncidentCreated(incident); // Execute initial response actions executeInitialResponse(incident); return incident; } public IncidentResponse escalateIncident(String incidentId, EscalationReason reason) { SecurityIncident incident = getIncident(incidentId); if (incident == null) { return new IncidentResponse(false, "Incident not found"); } IncidentEscalation escalation = new IncidentEscalation(); escalation.setIncidentId(incidentId); escalation.setReason(reason); escalation.setPreviousSeverity(incident.getSeverity()); escalation.setNewSeverity(calculateEscalatedSeverity(incident.getSeverity())); escalation.setEscalatedAt(new Date()); escalation.setEscalatedBy("System"); incident.setSeverity(escalation.getNewSeverity()); incident.setLastUpdated(new Date()); incident.addTimelineEvent(createTimelineEvent("INCIDENT_ESCALATED", "Incident escalated to " + escalation.getNewSeverity() + ": " + reason)); repository.save(incident); notifier.notifyIncidentEscalated(incident, escalation); return new IncidentResponse(true, "Incident escalated successfully"); } public IncidentResponse assignIncident(String incidentId, String assignee, String team) { SecurityIncident incident = getIncident(incidentId); if (incident == null) { return new IncidentResponse(false, "Incident not found"); } incident.setAssignee(assignee); incident.setAssignedTeam(team); incident.setStatus(IncidentStatus.INVESTIGATING); incident.setLastUpdated(new Date()); incident.addTimelineEvent(createTimelineEvent("INCIDENT_ASSIGNED", "Assigned to " + assignee + " (" + team + ")")); repository.save(incident); notifier.notifyIncidentAssigned(incident); return new IncidentResponse(true, "Incident assigned successfully"); } public IncidentResponse updateIncidentStatus(String incidentId, IncidentStatus status, String comment) { SecurityIncident incident = getIncident(incidentId); if (incident == null) { return new IncidentResponse(false, "Incident not found"); } IncidentStatus previousStatus = incident.getStatus(); incident.setStatus(status); incident.setLastUpdated(new Date()); incident.addTimelineEvent(createTimelineEvent("STATUS_CHANGED", "Status changed from " + previousStatus + " to " + status + ": " + comment)); repository.save(incident); notifier.notifyStatusUpdate(incident, previousStatus, status); // Execute status-specific actions executeStatusChangeActions(incident, previousStatus, status); return new IncidentResponse(true, "Incident status updated successfully"); } public IncidentResponse addEvidence(String incidentId, Evidence evidence) { SecurityIncident incident = getIncident(incidentId); if (incident == null) { return new IncidentResponse(false, "Incident not found"); } incident.addEvidence(evidence); incident.setLastUpdated(new Date()); incident.addTimelineEvent(createTimelineEvent("EVIDENCE_ADDED", "Evidence added: " + evidence.getType() + " - " + evidence.getDescription())); repository.save(incident); return new IncidentResponse(true, "Evidence added successfully"); } public IncidentResponse executeAction(String incidentId, IncidentAction action) { SecurityIncident incident = getIncident(incidentId); if (incident == null) { return new IncidentResponse(false, "Incident not found"); } action.setExecutedAt(new Date()); action.setStatus(ActionStatus.EXECUTING); // Store action incidentActions.computeIfAbsent(incidentId, k -> new ArrayList<>()).add(action); incident.addTimelineEvent(createTimelineEvent("ACTION_EXECUTED", "Action executed: " + action.getType() + " - " + action.getDescription())); // Execute the action try { ActionExecutor executor = getActionExecutor(action.getType()); ActionExecutionResult result = executor.execute(action, incident); action.setStatus(result.isSuccess() ? ActionStatus.COMPLETED : ActionStatus.FAILED); action.setResult(result.getMessage()); action.setCompletedAt(new Date()); incident.addTimelineEvent(createTimelineEvent("ACTION_COMPLETED", "Action " + (result.isSuccess() ? "completed" : "failed") + ": " + action.getType() + " - " + result.getMessage())); } catch (Exception e) { action.setStatus(ActionStatus.FAILED); action.setResult("Execution failed: " + e.getMessage()); incident.addTimelineEvent(createTimelineEvent("ACTION_FAILED", "Action failed: " + action.getType() + " - " + e.getMessage())); } repository.save(incident); return new IncidentResponse(true, "Action execution completed"); } public IncidentReport generateIncidentReport(String incidentId) { SecurityIncident incident = getIncident(incidentId); if (incident == null) { throw new IllegalArgumentException("Incident not found: " + incidentId); } List<IncidentAction> actions = incidentActions.getOrDefault(incidentId, Collections.emptyList()); return IncidentReport.builder() .incident(incident) .actions(actions) .timeline(incident.getTimeline()) .evidence(incident.getEvidence()) .metrics(calculateIncidentMetrics(incident, actions)) .recommendations(generateRecommendations(incident, actions)) .build(); } // Helper methods private void classifyIncident(SecurityIncident incident) { IncidentClassifier classifier = new IncidentClassifier(); IncidentClassification classification = classifier.classify(incident); incident.setCategory(classification.getCategory()); incident.setSubCategory(classification.getSubCategory()); incident.setConfidence(classification.getConfidence()); if (classification.getRecommendedSeverity() != null) { incident.setSeverity(classification.getRecommendedSeverity()); } } private void executeInitialResponse(SecurityIncident incident) { PlaybookExecutor playbook = new PlaybookExecutor(); List<IncidentAction> initialActions = playbook.getInitialResponseActions(incident); for (IncidentAction action : initialActions) { executeAction(incident.getId(), action); } } private void executeStatusChangeActions(SecurityIncident incident, IncidentStatus previousStatus, IncidentStatus newStatus) { PlaybookExecutor playbook = new PlaybookExecutor(); List<IncidentAction> statusActions = playbook.getStatusChangeActions( incident, previousStatus, newStatus); for (IncidentAction action : statusActions) { executeAction(incident.getId(), action); } } private IncidentSeverity calculateEscalatedSeverity(IncidentSeverity current) { switch (current) { case LOW: return IncidentSeverity.MEDIUM; case MEDIUM: return IncidentSeverity.HIGH; case HIGH: return IncidentSeverity.CRITICAL; case CRITICAL: return IncidentSeverity.CRITICAL; default: return IncidentSeverity.MEDIUM; } } private TimelineEvent createTimelineEvent(String type, String description) { TimelineEvent event = new TimelineEvent(); event.setType(type); event.setDescription(description); event.setTimestamp(new Date()); event.setActor("System"); return event; } private ActionExecutor getActionExecutor(ActionType type) { // Factory method to get appropriate executor switch (type) { case ISOLATE_SYSTEM: return new SystemIsolationExecutor(); case BLOCK_IP: return new IPBlockingExecutor(); case REVOKE_ACCESS: return new AccessRevocationExecutor(); case COLLECT_LOGS: return new LogCollectionExecutor(); case FORENSIC_ANALYSIS: return new ForensicAnalysisExecutor(); default: throw new IllegalArgumentException("Unknown action type: " + type); } } private IncidentMetrics calculateIncidentMetrics(SecurityIncident incident, List<IncidentAction> actions) { IncidentMetrics metrics = new IncidentMetrics(); metrics.setTimeToDetection(calculateTimeToDetection(incident)); metrics.setTimeToContainment(calculateTimeToContainment(incident, actions)); metrics.setTimeToResolution(calculateTimeToResolution(incident)); metrics.setActionsExecuted(actions.size()); metrics.setSuccessfulActions((int) actions.stream() .filter(a -> a.getStatus() == ActionStatus.COMPLETED) .count()); return metrics; } private long calculateTimeToDetection(SecurityIncident incident) { // Implementation would calculate time from first indicator to detection return 0L; } private long calculateTimeToContainment(SecurityIncident incident, List<IncidentAction> actions) { // Implementation would calculate time from detection to containment return 0L; } private long calculateTimeToResolution(SecurityIncident incident) { if (incident.getStatus() != IncidentStatus.RESOLVED) { return 0L; } // Calculate time from creation to resolution return incident.getResolvedAt().getTime() - incident.getCreatedAt().getTime(); } private List<String> generateRecommendations(SecurityIncident incident, List<IncidentAction> actions) { List<String> recommendations = new ArrayList<>(); // Generate recommendations based on incident type and actions taken if (incident.getCategory() == IncidentCategory.MALWARE) { recommendations.add("Conduct full system antivirus scan"); recommendations.add("Review and update antivirus signatures"); } if (incident.getCategory() == IncidentCategory.UNAUTHORIZED_ACCESS) { recommendations.add("Review and strengthen access controls"); recommendations.add("Implement multi-factor authentication"); } return recommendations; } private String generateIncidentId() { return "INC-" + System.currentTimeMillis() + "-" + UUID.randomUUID().toString().substring(0, 8).toUpperCase(); } public SecurityIncident getIncident(String incidentId) { return activeIncidents.get(incidentId); } public List<SecurityIncident> getActiveIncidents() { return new ArrayList<>(activeIncidents.values()); } public List<SecurityIncident> getIncidentsByStatus(IncidentStatus status) { return activeIncidents.values().stream() .filter(incident -> incident.getStatus() == status) .collect(Collectors.toList()); } // Data Classes public static class SecurityIncident { private String id; private String title; private String description; private IncidentSeverity severity; private IncidentCategory category; private String subCategory; private IncidentStatus status; private String reporter; private String assignee; private String assignedTeam; private Date createdAt; private Date lastUpdated; private Date resolvedAt; private double confidence; private List<Evidence> evidence = new ArrayList<>(); private List<TimelineEvent> timeline = new ArrayList<>(); private Map<String, String> metadata = new HashMap<>(); // Getters and setters public String getId() { return id; } public void setId(String id) { this.id = id; } public String getTitle() { return title; } public void setTitle(String title) { this.title = title; } public String getDescription() { return description; } public void setDescription(String description) { this.description = description; } public IncidentSeverity getSeverity() { return severity; } public void setSeverity(IncidentSeverity severity) { this.severity = severity; } public IncidentCategory getCategory() { return category; } public void setCategory(IncidentCategory category) { this.category = category; } public String getSubCategory() { return subCategory; } public void setSubCategory(String subCategory) { this.subCategory = subCategory; } public IncidentStatus getStatus() { return status; } public void setStatus(IncidentStatus status) { this.status = status; } public String getReporter() { return reporter; } public void setReporter(String reporter) { this.reporter = reporter; } public String getAssignee() { return assignee; } public void setAssignee(String assignee) { this.assignee = assignee; } public String getAssignedTeam() { return assignedTeam; } public void setAssignedTeam(String assignedTeam) { this.assignedTeam = assignedTeam; } public Date getCreatedAt() { return createdAt; } public void setCreatedAt(Date createdAt) { this.createdAt = createdAt; } public Date getLastUpdated() { return lastUpdated; } public void setLastUpdated(Date lastUpdated) { this.lastUpdated = lastUpdated; } public Date getResolvedAt() { return resolvedAt; } public void setResolvedAt(Date resolvedAt) { this.resolvedAt = resolvedAt; } public double getConfidence() { return confidence; } public void setConfidence(double confidence) { this.confidence = confidence; } public List<Evidence> getEvidence() { return evidence; } public void setEvidence(List<Evidence> evidence) { this.evidence = evidence; } public void addEvidence(Evidence evidence) { this.evidence.add(evidence); } public List<TimelineEvent> getTimeline() { return timeline; } public void setTimeline(List<TimelineEvent> timeline) { this.timeline = timeline; } public void addTimelineEvent(TimelineEvent event) { this.timeline.add(event); } public Map<String, String> getMetadata() { return metadata; } public void setMetadata(Map<String, String> metadata) { this.metadata = metadata; } } public enum IncidentSeverity { LOW, MEDIUM, HIGH, CRITICAL } public enum IncidentCategory { MALWARE, UNAUTHORIZED_ACCESS, DATA_BREACH, DOS_ATTACK, PHISHING, INSIDER_THREAT, CONFIGURATION_ERROR, VULNERABILITY_EXPLOIT } public enum IncidentStatus { NEW, INVESTIGATING, CONTAINED, ERADICATED, RESOLVED, CLOSED, REOPENED } public static class IncidentCreationRequest { private String title; private String description; private IncidentSeverity severity; private IncidentCategory category; private String reporter; // Getters and setters public String getTitle() { return title; } public void setTitle(String title) { this.title = title; } public String getDescription() { return description; } public void setDescription(String description) { this.description = description; } public IncidentSeverity getSeverity() { return severity; } public void setSeverity(IncidentSeverity severity) { this.severity = severity; } public IncidentCategory getCategory() { return category; } public void setCategory(IncidentCategory category) { this.category = category; } public String getReporter() { return reporter; } public void setReporter(String reporter) { this.reporter = reporter; } } public static class IncidentResponse { private boolean success; private String message; private String incidentId; public IncidentResponse(boolean success, String message) { this.success = success; this.message = message; } // Getters and setters public boolean isSuccess() { return success; } public void setSuccess(boolean success) { this.success = success; } public String getMessage() { return message; } public void setMessage(String message) { this.message = message; } public String getIncidentId() { return incidentId; } public void setIncidentId(String incidentId) { this.incidentId = incidentId; } } }

Playbook Execution Engine

2. Automated Playbook Executor

package com.example.security.incident; import org.springframework.stereotype.Component; import java.util.*; @Component public class PlaybookExecutor { private final Map<IncidentCategory, IncidentPlaybook> playbooks; private final Map<IncidentStatus, List<ActionType>> statusActions; public PlaybookExecutor() { this.playbooks = loadPlaybooks(); this.statusActions = loadStatusActions(); } public List<IncidentAction> getInitialResponseActions(SecurityIncident incident) { IncidentPlaybook playbook = playbooks.get(incident.getCategory()); if (playbook == null) { return getDefaultInitialActions(incident); } return playbook.getInitialResponseActions(incident); } public List<IncidentAction> getContainmentActions(SecurityIncident incident) { IncidentPlaybook playbook = playbooks.get(incident.getCategory()); if (playbook == null) { return getDefaultContainmentActions(incident); } return playbook.getContainmentActions(incident); } public List<IncidentAction> getEradicationActions(SecurityIncident incident) { IncidentPlaybook playbook = playbooks.get(incident.getCategory()); if (playbook == null) { return getDefaultEradicationActions(incident); } return playbook.getEradicationActions(incident); } public List<IncidentAction> getRecoveryActions(SecurityIncident incident) { IncidentPlaybook playbook = playbooks.get(incident.getCategory()); if (playbook == null) { return getDefaultRecoveryActions(incident); } return playbook.getRecoveryActions(incident); } public List<IncidentAction> getStatusChangeActions(SecurityIncident incident, IncidentStatus previousStatus, IncidentStatus newStatus) { List<IncidentAction> actions = new ArrayList<>(); if (newStatus == IncidentStatus.CONTAINED) { actions.addAll(getContainmentActions(incident)); } else if (newStatus == IncidentStatus.ERADICATED) { actions.addAll(getEradicationActions(incident)); } else if (newStatus == IncidentStatus.RESOLVED) { actions.addAll(getRecoveryActions(incident)); } return actions; } public IncidentPlaybook getPlaybook(IncidentCategory category) { return playbooks.get(category); } public void executePlaybookStep(String incidentId, String stepId) { // Implementation for executing specific playbook steps } // Default action implementations private List<IncidentAction> getDefaultInitialActions(SecurityIncident incident) { List<IncidentAction> actions = new ArrayList<>(); // Common initial actions for any incident actions.add(createAction(ActionType.COLLECT_LOGS, "Collect relevant system and application logs", incident)); actions.add(createAction(ActionType.PRESERVE_EVIDENCE, "Preserve current system state for forensic analysis", incident)); actions.add(createAction(ActionType.NOTIFY_STAKEHOLDERS, "Notify relevant stakeholders about the incident", incident)); return actions; } private List<IncidentAction> getDefaultContainmentActions(SecurityIncident incident) { List<IncidentAction> actions = new ArrayList<>(); if (incident.getSeverity() == IncidentSeverity.HIGH || incident.getSeverity() == IncidentSeverity.CRITICAL) { actions.add(createAction(ActionType.ISOLATE_SYSTEM, "Isolate affected systems from network", incident)); } actions.add(createAction(ActionType.BLOCK_IP, "Block malicious IP addresses", incident)); actions.add(createAction(ActionType.REVOKE_ACCESS, "Revoke compromised user access", incident)); return actions; } private List<IncidentAction> getDefaultEradicationActions(SecurityIncident incident) { List<IncidentAction> actions = new ArrayList<>(); actions.add(createAction(ActionType.REMOVE_MALWARE, "Remove identified malware or malicious code", incident)); actions.add(createAction(ActionType.PATCH_VULNERABILITIES, "Apply security patches for exploited vulnerabilities", incident)); actions.add(createAction(ActionType.CHANGE_CREDENTIALS, "Change compromised passwords and keys", incident)); return actions; } private List<IncidentAction> getDefaultRecoveryActions(SecurityIncident incident) { List<IncidentAction> actions = new ArrayList<>(); actions.add(createAction(ActionType.RESTORE_SYSTEMS, "Restore systems from clean backups", incident)); actions.add(createAction(ActionType.VERIFY_INTEGRITY, "Verify system integrity and functionality", incident)); actions.add(createAction(ActionType.MONITOR_SYSTEMS, "Enhanced monitoring of recovered systems", incident)); return actions; } private IncidentAction createAction(ActionType type, String description, SecurityIncident incident) { IncidentAction action = new IncidentAction(); action.setId(generateActionId()); action.setType(type); action.setDescription(description); action.setIncidentId(incident.getId()); action.setCreatedAt(new Date()); action.setStatus(ActionStatus.PENDING); return action; } private Map<IncidentCategory, IncidentPlaybook> loadPlaybooks() { Map<IncidentCategory, IncidentPlaybook> playbooks = new HashMap<>(); // Malware Incident Playbook playbooks.put(IncidentCategory.MALWARE, createMalwarePlaybook()); // Unauthorized Access Playbook playbooks.put(IncidentCategory.UNAUTHORIZED_ACCESS, createUnauthorizedAccessPlaybook()); // Data Breach Playbook playbooks.put(IncidentCategory.DATA_BREACH, createDataBreachPlaybook()); // DDoS Attack Playbook playbooks.put(IncidentCategory.DOS_ATTACK, createDDoSPlaybook()); return playbooks; } private Map<IncidentStatus, List<ActionType>> loadStatusActions() { Map<IncidentStatus, List<ActionType>> actions = new HashMap<>(); actions.put(IncidentStatus.INVESTIGATING, Arrays.asList( ActionType.COLLECT_LOGS, ActionType.ANALYZE_LOGS, ActionType.IDENTIFY_SCOPE )); actions.put(IncidentStatus.CONTAINED, Arrays.asList( ActionType.ISOLATE_SYSTEM, ActionType.BLOCK_IP, ActionType.REVOKE_ACCESS )); actions.put(IncidentStatus.ERADICATED, Arrays.asList( ActionType.REMOVE_MALWARE, ActionType.PATCH_VULNERABILITIES, ActionType.CHANGE_CREDENTIALS )); actions.put(IncidentStatus.RESOLVED, Arrays.asList( ActionType.RESTORE_SYSTEMS, ActionType.VERIFY_INTEGRITY, ActionType.MONITOR_SYSTEMS )); return actions; } private IncidentPlaybook createMalwarePlaybook() { return new IncidentPlaybook() { @Override public List<IncidentAction> getInitialResponseActions(SecurityIncident incident) { List<IncidentAction> actions = new ArrayList<>(); actions.add(createAction(ActionType.ISOLATE_SYSTEM, "Isolate infected system from network", incident)); actions.add(createAction(ActionType.COLLECT_MALWARE_SAMPLES, "Collect malware samples for analysis", incident)); actions.add(createAction(ActionType.SCAN_NETWORK, "Scan network for similar infections", incident)); return actions; } @Override public List<IncidentAction> getContainmentActions(SecurityIncident incident) { List<IncidentAction> actions = new ArrayList<>(); actions.add(createAction(ActionType.QUARANTINE_MALWARE, "Quarantine identified malware", incident)); actions.add(createAction(ActionType.BLOCK_COMMUNICATION, "Block C&C server communication", incident)); return actions; } @Override public List<IncidentAction> getEradicationActions(SecurityIncident incident) { List<IncidentAction> actions = new ArrayList<>(); actions.add(createAction(ActionType.REMOVE_MALWARE, "Remove malware using antivirus tools", incident)); actions.add(createAction(ActionType.CLEAN_SYSTEM, "Clean infected system thoroughly", incident)); return actions; } }; } private IncidentPlaybook createUnauthorizedAccessPlaybook() { return new IncidentPlaybook() { @Override public List<IncidentAction> getInitialResponseActions(SecurityIncident incident) { List<IncidentAction> actions = new ArrayList<>(); actions.add(createAction(ActionType.REVOKE_ACCESS, "Revoke compromised account access", incident)); actions.add(createAction(ActionType.ANALYZE_ACCESS_LOGS, "Analyze authentication and access logs", incident)); actions.add(createAction(ActionType.IDENTIFY_ACCESS_METHOD, "Identify method of unauthorized access", incident)); return actions; } @Override public List<IncidentAction> getContainmentActions(SecurityIncident incident) { List<IncidentAction> actions = new ArrayList<>(); actions.add(createAction(ActionType.BLOCK_IP, "Block source IP addresses", incident)); actions.add(createAction(ActionType.DISABLE_ACCOUNTS, "Disable compromised accounts", incident)); return actions; } @Override public List<IncidentAction> getEradicationActions(SecurityIncident incident) { List<IncidentAction> actions = new ArrayList<>(); actions.add(createAction(ActionType.PATCH_VULNERABILITIES, "Patch exploited vulnerabilities", incident)); actions.add(createAction(ActionType.STRENGTHEN_AUTHENTICATION, "Strengthen authentication mechanisms", incident)); return actions; } }; } private IncidentPlaybook createDataBreachPlaybook() { return new IncidentPlaybook() { @Override public List<IncidentAction> getInitialResponseActions(SecurityIncident incident) { List<IncidentAction> actions = new ArrayList<>(); actions.add(createAction(ActionType.IDENTIFY_DATA_SCOPE, "Identify scope of compromised data", incident)); actions.add(createAction(ActionType.SECURE_DATA_STORAGE, "Secure remaining data storage", incident)); actions.add(createAction(ActionType.NOTIFY_LEGAL, "Notify legal team for compliance requirements", incident)); return actions; } @Override public List<IncidentAction> getContainmentActions(SecurityIncident incident) { List<IncidentAction> actions = new ArrayList<>(); actions.add(createAction(ActionType.BLOCK_DATA_EXFILTRATION, "Block data exfiltration channels", incident)); actions.add(createAction(ActionType.ENCRYPT_SENSITIVE_DATA, "Encrypt remaining sensitive data", incident)); return actions; } @Override public List<IncidentAction> getEradicationActions(SecurityIncident incident) { List<IncidentAction> actions = new ArrayList<>(); actions.add(createAction(ActionType.IMPLEMENT_ACCESS_CONTROLS, "Implement stronger data access controls", incident)); actions.add(createAction(ActionType.MONITOR_DATA_ACCESS, "Implement enhanced data access monitoring", incident)); return actions; } }; } private IncidentPlaybook createDDoSPlaybook() { return new IncidentPlaybook() { @Override public List<IncidentAction> getInitialResponseActions(SecurityIncident incident) { List<IncidentAction> actions = new ArrayList<>(); actions.add(createAction(ActionType.ACTIVATE_DDOS_PROTECTION, "Activate DDoS mitigation services", incident)); actions.add(createAction(ActionType.ANALYZE_TRAFFIC_PATTERNS, "Analyze attack traffic patterns", incident)); actions.add(createAction(ActionType.NOTIFY_ISP, "Notify ISP for upstream mitigation", incident)); return actions; } @Override public List<IncidentAction> getContainmentActions(SecurityIncident incident) { List<IncidentAction> actions = new ArrayList<>(); actions.add(createAction(ActionType.BLOCK_MALICIOUS_TRAFFIC, "Block malicious traffic at network perimeter", incident)); actions.add(createAction(ActionType.RATE_LIMIT_REQUESTS, "Implement request rate limiting", incident)); return actions; } @Override public List<IncidentAction> getEradicationActions(SecurityIncident incident) { List<IncidentAction> actions = new ArrayList<>(); actions.add(createAction(ActionType.IMPLEMENT_TRAFFIC_FILTERING, "Implement permanent traffic filtering rules", incident)); actions.add(createAction(ActionType.ENHANCE_CAPACITY, "Enhance infrastructure capacity", incident)); return actions; } }; } private String generateActionId() { return "ACT-" + System.currentTimeMillis() + "-" + UUID.randomUUID().toString().substring(0, 6).toUpperCase(); } // Interface for playbooks public interface IncidentPlaybook { List<IncidentAction> getInitialResponseActions(SecurityIncident incident); List<IncidentAction> getContainmentActions(SecurityIncident incident); List<IncidentAction> getEradicationActions(SecurityIncident incident); default List<IncidentAction> getRecoveryActions(SecurityIncident incident) { return getDefaultRecoveryActions(incident); } } }

Action Execution Framework

3. Action Executors

package com.example.security.incident; import org.springframework.stereotype.Component; import java.util.*; // Base interface for all action executors @Component public interface ActionExecutor { ActionExecutionResult execute(IncidentAction action, SecurityIncident incident); ActionType getSupportedActionType(); } // System Isolation Executor @Component public class SystemIsolationExecutor implements ActionExecutor { private final NetworkService networkService; private final SystemInventoryService inventoryService; public SystemIsolationExecutor(NetworkService networkService, SystemInventoryService inventoryService) { this.networkService = networkService; this.inventoryService = inventoryService; } @Override public ActionExecutionResult execute(IncidentAction action, SecurityIncident incident) { try { // Extract target systems from action parameters or incident evidence List<String> targetSystems = extractTargetSystems(action, incident); if (targetSystems.isEmpty()) { return new ActionExecutionResult(false, "No target systems specified for isolation"); } List<String> isolationResults = new ArrayList<>(); for (String system : targetSystems) { // Isolate system from network boolean isolated = networkService.isolateSystem(system); if (isolated) { isolationResults.add("Successfully isolated: " + system); } else { isolationResults.add("Failed to isolate: " + system); } } String message = String.format("Isolated %d systems: %s", targetSystems.size(), String.join(", ", isolationResults)); return new ActionExecutionResult(true, message); } catch (Exception e) { return new ActionExecutionResult(false, "System isolation failed: " + e.getMessage()); } } @Override public ActionType getSupportedActionType() { return ActionType.ISOLATE_SYSTEM; } private List<String> extractTargetSystems(IncidentAction action, SecurityIncident incident) { List<String> systems = new ArrayList<>(); // Extract from action parameters if (action.getParameters() != null && action.getParameters().containsKey("targetSystems")) { String[] targetSystems = action.getParameters().get("targetSystems").split(","); systems.addAll(Arrays.asList(targetSystems)); } // Extract from incident evidence for (Evidence evidence : incident.getEvidence()) { if (evidence.getType() == EvidenceType.SYSTEM_LOG && evidence.getContent().contains("compromised")) { // Parse system identifiers from evidence String systemId = extractSystemIdFromEvidence(evidence); if (systemId != null) { systems.add(systemId); } } } return systems; } private String extractSystemIdFromEvidence(Evidence evidence) { // Implementation to extract system identifier from evidence return "system-" + evidence.getId(); } } // IP Blocking Executor @Component public class IPBlockingExecutor implements ActionExecutor { private final FirewallService firewallService; private final ThreatIntelligenceService threatIntelService; public IPBlockingExecutor(FirewallService firewallService, ThreatIntelligenceService threatIntelService) { this.firewallService = firewallService; this.threatIntelService = threatIntelService; } @Override public ActionExecutionResult execute(IncidentAction action, SecurityIncident incident) { try { Set<String> ipsToBlock = extractIPsToBlock(action, incident); if (ipsToBlock.isEmpty()) { return new ActionExecutionResult(false, "No IP addresses specified for blocking"); } List<String> blockResults = new ArrayList<>(); int successfullyBlocked = 0; for (String ip : ipsToBlock) { if (isValidIP(ip) && !isInternalIP(ip)) { boolean blocked = firewallService.blockIP(ip, "Security Incident: " + incident.getId()); if (blocked) { successfullyBlocked++; blockResults.add("Blocked: " + ip); // Add to threat intelligence threatIntelService.addMaliciousIP(ip, incident.getId(), "Blocked during incident response"); } else { blockResults.add("Failed to block: " + ip); } } else { blockResults.add("Skipped invalid/internal IP: " + ip); } } String message = String.format("Blocked %d/%d IPs: %s", successfullyBlocked, ipsToBlock.size(), String.join(", ", blockResults)); return new ActionExecutionResult(true, message); } catch (Exception e) { return new ActionExecutionResult(false, "IP blocking failed: " + e.getMessage()); } } @Override public ActionType getSupportedActionType() { return ActionType.BLOCK_IP; } private Set<String> extractIPsToBlock(IncidentAction action, SecurityIncident incident) { Set<String> ips = new HashSet<>(); // Extract from action parameters if (action.getParameters() != null && action.getParameters().containsKey("ipAddresses")) { String[] ipArray = action.getParameters().get("ipAddresses").split(","); ips.addAll(Arrays.asList(ipArray)); } // Extract from incident evidence for (Evidence evidence : incident.getEvidence()) { if (evidence.getType() == EvidenceType.NETWORK_LOG) { Set<String> foundIPs = extractIPsFromEvidence(evidence); ips.addAll(foundIPs); } } return ips; } private Set<String> extractIPsFromEvidence(Evidence evidence) { // Implementation to extract IP addresses from evidence content Set<String> ips = new HashSet<>(); // Simple IP regex pattern matching String ipPattern = "\\b(?:[0-9]{1,3}\\.){3}[0-9]{1,3}\\b"; // Actual implementation would use proper IP parsing return ips; } private boolean isValidIP(String ip) { // Basic IP validation return ip.matches("\\b(?:[0-9]{1,3}\\.){3}[0-9]{1,3}\\b"); } private boolean isInternalIP(String ip) { // Check if IP is in private ranges return ip.startsWith("10.") || ip.startsWith("192.168.") || (ip.startsWith("172.") && isInPrivateRange(ip)); } private boolean isInPrivateRange(String ip) { // Check 172.16.0.0 - 172.31.255.255 String[] parts = ip.split("\\."); if (parts.length >= 2) { int secondOctet = Integer.parseInt(parts[1]); return secondOctet >= 16 && secondOctet <= 31; } return false; } } // Access Revocation Executor @Component public class AccessRevocationExecutor implements ActionExecutor { private final IdentityManagementService idmService; private final AccessReviewService accessReviewService; public AccessRevocationExecutor(IdentityManagementService idmService, AccessReviewService accessReviewService) { this.idmService = idmService; this.accessReviewService = accessReviewService; } @Override public ActionExecutionResult execute(IncidentAction action, SecurityIncident incident) { try { Set<String> usersToRevoke = extractUsersToRevoke(action, incident); if (usersToRevoke.isEmpty()) { return new ActionExecutionResult(false, "No users specified for access revocation"); } List<String> revocationResults = new ArrayList<>(); int successfullyRevoked = 0; for (String username : usersToRevoke) { boolean revoked = idmService.revokeUserAccess(username, "Security Incident: " + incident.getId()); if (revoked) { successfullyRevoked++; revocationResults.add("Revoked: " + username); // Schedule access review accessReviewService.scheduleUserAccessReview(username, "Post-incident access review"); } else { revocationResults.add("Failed to revoke: " + username); } } String message = String.format("Revoked access for %d/%d users: %s", successfullyRevoked, usersToRevoke.size(), String.join(", ", revocationResults)); return new ActionExecutionResult(true, message); } catch (Exception e) { return new ActionExecutionResult(false, "Access revocation failed: " + e.getMessage()); } } @Override public ActionType getSupportedActionType() { return ActionType.REVOKE_ACCESS; } private Set<String> extractUsersToRevoke(IncidentAction action, SecurityIncident incident) { Set<String> users = new HashSet<>(); // Extract from action parameters if (action.getParameters() != null && action.getParameters().containsKey("usernames")) { String[] userArray = action.getParameters().get("usernames").split(","); users.addAll(Arrays.asList(userArray)); } // Extract from incident evidence for (Evidence evidence : incident.getEvidence()) { if (evidence.getType() == EvidenceType.ACCESS_LOG) { Set<String> foundUsers = extractUsersFromEvidence(evidence); users.addAll(foundUsers); } } return users; } private Set<String> extractUsersFromEvidence(Evidence evidence) { // Implementation to extract usernames from evidence content return new HashSet<>(); } } // Data Classes for Actions public class IncidentAction { private String id; private ActionType type; private String description; private String incidentId; private ActionStatus status; private Date createdAt; private Date executedAt; private Date completedAt; private String result; private Map<String, String> parameters = new HashMap<>(); // Getters and setters public String getId() { return id; } public void setId(String id) { this.id = id; } public ActionType getType() { return type; } public void setType(ActionType type) { this.type = type; } public String getDescription() { return description; } public void setDescription(String description) { this.description = description; } public String getIncidentId() { return incidentId; } public void setIncidentId(String incidentId) { this.incidentId = incidentId; } public ActionStatus getStatus() { return status; } public void setStatus(ActionStatus status) { this.status = status; } public Date getCreatedAt() { return createdAt; } public void setCreatedAt(Date createdAt) { this.createdAt = createdAt; } public Date getExecutedAt() { return executedAt; } public void setExecutedAt(Date executedAt) { this.executedAt = executedAt; } public Date getCompletedAt() { return completedAt; } public void setCompletedAt(Date completedAt) { this.completedAt = completedAt; } public String getResult() { return result; } public void setResult(String result) { this.result = result; } public Map<String, String> getParameters() { return parameters; } public void setParameters(Map<String, String> parameters) { this.parameters = parameters; } } public enum ActionType { ISOLATE_SYSTEM, BLOCK_IP, REVOKE_ACCESS, COLLECT_LOGS, COLLECT_MALWARE_SAMPLES, SCAN_NETWORK, QUARANTINE_MALWARE, BLOCK_COMMUNICATION, REMOVE_MALWARE, CLEAN_SYSTEM, ANALYZE_ACCESS_LOGS, IDENTIFY_ACCESS_METHOD, DISABLE_ACCOUNTS, PATCH_VULNERABILITIES, STRENGTHEN_AUTHENTICATION, IDENTIFY_DATA_SCOPE, SECURE_DATA_STORAGE, NOTIFY_LEGAL, BLOCK_DATA_EXFILTRATION, ENCRYPT_SENSITIVE_DATA, IMPLEMENT_ACCESS_CONTROLS, MONITOR_DATA_ACCESS, ACTIVATE_DDOS_PROTECTION, ANALYZE_TRAFFIC_PATTERNS, NOTIFY_ISP, BLOCK_MALICIOUS_TRAFFIC, RATE_LIMIT_REQUESTS, IMPLEMENT_TRAFFIC_FILTERING, ENHANCE_CAPACITY, PRESERVE_EVIDENCE, NOTIFY_STAKEHOLDERS, ANALYZE_LOGS, IDENTIFY_SCOPE, CHANGE_CREDENTIALS, RESTORE_SYSTEMS, VERIFY_INTEGRITY, MONITOR_SYSTEMS, FORENSIC_ANALYSIS } public enum ActionStatus { PENDING, EXECUTING, COMPLETED, FAILED, CANCELLED } public class ActionExecutionResult { private boolean success; private String message; private Map<String, Object> details = new HashMap<>(); public ActionExecutionResult(boolean success, String message) { this.success = success; this.message = message; } // Getters and setters public boolean isSuccess() { return success; } public void setSuccess(boolean success) { this.success = success; } public String getMessage() { return message; } public void setMessage(String message) { this.message = message; } public Map<String, Object> getDetails() { return details; } public void setDetails(Map<String, Object> details) { this.details = details; } }

Incident Classification and Analysis

4. Intelligent Incident Classifier

package com.example.security.incident; import org.springframework.stereotype.Component; import java.util.*; import java.util.regex.Pattern; @Component public class IncidentClassifier { private final Map<Pattern, IncidentCategory> patternCategories; private final Map<String, Double> keywordWeights; public IncidentClassifier() { this.patternCategories = initializePatterns(); this.keywordWeights = initializeKeywordWeights(); } public IncidentClassification classify(SecurityIncident incident) { String text = incident.getTitle() + " " + incident.getDescription(); text = text.toLowerCase(); Map<IncidentCategory, Double> categoryScores = new HashMap<>(); Map<String, Double> featureScores = new HashMap<>(); // Pattern-based classification for (Map.Entry<Pattern, IncidentCategory> entry : patternCategories.entrySet()) { if (entry.getKey().matcher(text).find()) { categoryScores.merge(entry.getValue(), 1.0, Double::sum); } } // Keyword-based classification for (Map.Entry<String, Double> entry : keywordWeights.entrySet()) { if (text.contains(entry.getKey())) { String category = getCategoryFromKeyword(entry.getKey()); IncidentCategory incidentCategory = IncidentCategory.valueOf(category); categoryScores.merge(incidentCategory, entry.getValue(), Double::sum); featureScores.put(entry.getKey(), entry.getValue()); } } // Determine primary category IncidentCategory primaryCategory = determinePrimaryCategory(categoryScores); String subCategory = determineSubCategory(primaryCategory, featureScores); double confidence = calculateConfidence(categoryScores, primaryCategory); // Determine severity based on features IncidentSeverity recommendedSeverity = determineSeverity(primaryCategory, featureScores); return new IncidentClassification(primaryCategory, subCategory, confidence, recommendedSeverity); } public List<IncidentCategory> getPossibleCategories(SecurityIncident incident) { IncidentClassification classification = classify(incident); // Return top 3 possible categories based on confidence return Arrays.asList( classification.getCategory(), getSecondaryCategory(incident), getTertiaryCategory(incident) ); } public boolean requiresImmediateAttention(SecurityIncident incident) { IncidentClassification classification = classify(incident); return classification.getConfidence() > 0.8 && (classification.getRecommendedSeverity() == IncidentSeverity.HIGH || classification.getRecommendedSeverity() == IncidentSeverity.CRITICAL); } // Helper methods private Map<Pattern, IncidentCategory> initializePatterns() { Map<Pattern, IncidentCategory> patterns = new HashMap<>(); // Malware patterns patterns.put(Pattern.compile("\\b(malware|virus|trojan|ransomware|worm)\\b"), IncidentCategory.MALWARE); patterns.put(Pattern.compile("\\b(infected|compromised.system)\\b"), IncidentCategory.MALWARE); // Unauthorized access patterns patterns.put(Pattern.compile("\\b(unauthorized.access|breach|intrusion|hack)\\b"), IncidentCategory.UNAUTHORIZED_ACCESS); patterns.put(Pattern.compile("\\b(credential.theft|password.breach)\\b"), IncidentCategory.UNAUTHORIZED_ACCESS); // Data breach patterns patterns.put(Pattern.compile("\\b(data.breach|data.leak|pii.exposure)\\b"), IncidentCategory.DATA_BREACH); patterns.put(Pattern.compile("\\b(sensitive.data|personal.information)\\b"), IncidentCategory.DATA_BREACH); // DDoS patterns patterns.put(Pattern.compile("\\b(ddos|denial.of.service|service.unavailable)\\b"), IncidentCategory.DOS_ATTACK); patterns.put(Pattern.compile("\\b(flood.attack|traffic.surge)\\b"), IncidentCategory.DOS_ATTACK); return patterns; } private Map<String, Double> initializeKeywordWeights() { Map<String, Double> weights = new HashMap<>(); // Malware keywords weights.put("malware", 2.0); weights.put("virus", 1.5); weights.put("ransomware", 2.5); weights.put("infected", 1.0); // Access compromise keywords weights.put("unauthorized", 2.0); weights.put("breach", 2.5); weights.put("compromised", 1.5); weights.put("intrusion", 2.0); // Data exposure keywords weights.put("data leak", 3.0); weights.put("pii", 2.5); weights.put("sensitive", 1.5); // Availability keywords weights.put("ddos", 2.0); weights.put("outage", 1.5); weights.put("unavailable", 1.0); return weights; } private String getCategoryFromKeyword(String keyword) { // Map keywords to categories switch (keyword) { case "malware": case "virus": case "ransomware": case "infected": return "MALWARE"; case "unauthorized": case "breach": case "compromised": case "intrusion": return "UNAUTHORIZED_ACCESS"; case "data leak": case "pii": case "sensitive": return "DATA_BREACH"; case "ddos": case "outage": case "unavailable": return "DOS_ATTACK"; default: return "UNAUTHORIZED_ACCESS"; } } private IncidentCategory determinePrimaryCategory(Map<IncidentCategory, Double> scores) { return scores.entrySet().stream() .max(Map.Entry.comparingByValue()) .map(Map.Entry::getKey) .orElse(IncidentCategory.UNAUTHORIZED_ACCESS); } private String determineSubCategory(IncidentCategory category, Map<String, Double> features) { switch (category) { case MALWARE: return determineMalwareSubCategory(features); case UNAUTHORIZED_ACCESS: return determineAccessSubCategory(features); case DATA_BREACH: return determineBreachSubCategory(features); case DOS_ATTACK: return determineDDoSSubCategory(features); default: return "GENERIC"; } } private String determineMalwareSubCategory(Map<String, Double> features) { if (features.containsKey("ransomware")) return "RANSOMWARE"; if (features.containsKey("trojan")) return "TROJAN"; if (features.containsKey("virus")) return "VIRUS"; return "MALWARE_GENERIC"; } private String determineAccessSubCategory(Map<String, Double> features) { if (features.containsKey("credential")) return "CREDENTIAL_THEFT"; if (features.containsKey("privilege")) return "PRIVILEGE_ESCALATION"; return "UNAUTHORIZED_ACCESS_GENERIC"; } private String determineBreachSubCategory(Map<String, Double> features) { if (features.containsKey("pii")) return "PII_EXPOSURE"; if (features.containsKey("financial")) return "FINANCIAL_DATA_BREACH"; return "DATA_BREACH_GENERIC"; } private String determineDDoSSubCategory(Map<String, Double> features) { if (features.containsKey("application")) return "APPLICATION_DDOS"; if (features.containsKey("network")) return "NETWORK_DDOS"; return "DOS_ATTACK_GENERIC"; } private double calculateConfidence(Map<IncidentCategory, Double> scores, IncidentCategory primary) { double primaryScore = scores.getOrDefault(primary, 0.0); double totalScore = scores.values().stream().mapToDouble(Double::doubleValue).sum(); if (totalScore == 0) return 0.0; return primaryScore / totalScore; } private IncidentSeverity determineSeverity(IncidentCategory category, Map<String, Double> features) { // Base severity based on category Map<IncidentCategory, IncidentSeverity> baseSeverity = new HashMap<>(); baseSeverity.put(IncidentCategory.MALWARE, IncidentSeverity.HIGH); baseSeverity.put(IncidentCategory.UNAUTHORIZED_ACCESS, IncidentSeverity.HIGH); baseSeverity.put(IncidentCategory.DATA_BREACH, IncidentSeverity.CRITICAL); baseSeverity.put(IncidentCategory.DOS_ATTACK, IncidentSeverity.MEDIUM); IncidentSeverity severity = baseSeverity.getOrDefault(category, IncidentSeverity.MEDIUM); // Adjust based on features if (features.containsKey("ransomware")) { severity = IncidentSeverity.CRITICAL; } if (features.containsKey("pii") && category == IncidentCategory.DATA_BREACH) { severity = IncidentSeverity.CRITICAL; } return severity; } private IncidentCategory getSecondaryCategory(SecurityIncident incident) { // Implementation to determine secondary category return IncidentCategory.UNAUTHORIZED_ACCESS; } private IncidentCategory getTertiaryCategory(SecurityIncident incident) { // Implementation to determine tertiary category return IncidentCategory.CONFIGURATION_ERROR; } // Data Classes public static class IncidentClassification { private final IncidentCategory category; private final String subCategory; private final double confidence; private final IncidentSeverity recommendedSeverity; public IncidentClassification(IncidentCategory category, String subCategory, double confidence, IncidentSeverity recommendedSeverity) { this.category = category; this.subCategory = subCategory; this.confidence = confidence; this.recommendedSeverity = recommendedSeverity; } // Getters public IncidentCategory getCategory() { return category; } public String getSubCategory() { return subCategory; } public double getConfidence() { return confidence; } public IncidentSeverity getRecommendedSeverity() { return recommendedSeverity; } } }

Spring Boot Configuration

5. Application Configuration

package com.example.security.config; import org.springframework.beans.factory.annotation.Value; import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Configuration; @Configuration public class IncidentResponseConfig { @Value("${incident.response.notification.enabled:true}") private boolean notificationEnabled; @Value("${incident.response.escalation.enabled:true}") private boolean escalationEnabled; @Value("${incident.response.auto.containment.enabled:false}") private boolean autoContainmentEnabled; @Value("${incident.response.playbook.default:standard}") private String defaultPlaybook; @Bean public IncidentManager incidentManager(IncidentNotifier notifier, IncidentRepository repository) { return new IncidentManager(notifier, repository); } @Bean public PlaybookExecutor playbookExecutor() { return new PlaybookExecutor(); } @Bean public IncidentClassifier incidentClassifier() { return new IncidentClassifier(); } @Bean public SystemIsolationExecutor systemIsolationExecutor() { return new SystemIsolationExecutor(); } @Bean public IPBlockingExecutor ipBlockingExecutor() { return new IPBlockingExecutor(); } @Bean public AccessRevocationExecutor accessRevocationExecutor() { return new AccessRevocationExecutor(); } } // application.yml incident: response: notification: enabled: true channels: - email - slack - sms escalation: enabled: true thresholds: critical: 30 # minutes high: 60 # minutes auto-containment: enabled: false actions: - BLOCK_IP - REVOKE_ACCESS playbook: default: standard custom: malware: malware-response data-breach: data-breach-response security: incident: retention-days: 365 backup-enabled: true encryption-enabled: true logging: level: com.example.security.incident: INFO

This comprehensive Security Incident Response Playbook implementation provides:

1. Incident Management - Creation, tracking, and lifecycle management
2. Playbook Execution - Automated response workflows for different incident types
3. Action Automation - Executors for containment, eradication, and recovery actions
4. Intelligent Classification - AI-powered incident categorization and severity assessment
5. Comprehensive Reporting - Detailed incident reports with metrics and recommendations

The system enables organizations to respond to security incidents quickly, consistently, and effectively while maintaining detailed audit trails and compliance with security frameworks.