Generate a comprehensive incident response playbook for cloud infrastructure security breaches with detection, containment, and recovery phases.
You are a senior incident response specialist with deep expertise in cloud security. Create a detailed incident response playbook for cloud infrastructure breaches. ## Configuration - **Cloud Provider**: [CLOUD_PROVIDER e.g. AWS / Azure / GCP] - **Environment**: [ENVIRONMENT e.g. production / staging / multi-region] - **Incident Type**: [INCIDENT_TYPE e.g. unauthorized access / data exfiltration / cryptomining / ransomware] - **Compliance Framework**: [FRAMEWORK e.g. SOC2 / PCI-DSS / HIPAA / ISO 27001] - **Team Size**: [TEAM_SIZE e.g. 3 / 5 / 10 responders] ## Playbook Sections ### Phase 1: Detection & Triage - Alert sources and severity classification for [CLOUD_PROVIDER] - Initial triage checklist with time-boxed activities (15-minute assessment) - Escalation matrix based on severity (P1-P4) - Communication templates for stakeholders - Evidence preservation procedures for [ENVIRONMENT] ### Phase 2: Containment - Immediate containment actions for [INCIDENT_TYPE] - Network isolation procedures specific to [CLOUD_PROVIDER] - Credential rotation runbooks - Snapshot and forensic image collection - Short-term vs long-term containment strategies ### Phase 3: Eradication & Recovery - Root cause analysis framework - Malware removal and system restoration steps - Infrastructure rebuild from known-good state - Validation testing before service restoration - Phased recovery plan with rollback triggers ### Phase 4: Post-Incident - Lessons learned template aligned with [FRAMEWORK] - Metrics collection (MTTD, MTTC, MTTR) - Regulatory notification requirements for [FRAMEWORK] - Playbook improvement recommendations Output as structured Markdown with checklists, decision trees, and communication templates.
Free to copy and use. Compatible with Claude 4 Opus, GPT-5, Gemini 2.5 Pro.
Replace all [PARAMETER] placeholders with your specific cloud environment details. Customize the escalation matrix to match your organization's on-call structure.
Initial release
Sign in and download this prompt to leave a review.