Skip to content

Commit ebfce1e

Browse files
DicksonWu654scode2277
DicksonWu654
and
scode2277
authored
Incident response template integration (#407)
* Integrate incident response template into incident management * Remove attribution from imported incident response template pages * Fix incident response template MDX build issues * Reduce duplicated incident response content * Polish imported incident response formatting * Remove Obsidian wording from IR overview * Clean up remaining template placeholder text * Polish imported incident response metadata * Restructure incident response examples under templates * Move runbook template and remove incident attribution * Credit Nick on incident response template pages * Update contributors.json * Assign Isaac to incident response runbooks * Update docs/pages/incident-management/incident-response-template/runbooks/build-pipeline-compromise.mdx Co-authored-by: Sara Russo <sararusso984@gmail.com> * Remove unnecessary footer separators * Restore incident management attribution blocks * Update docs/pages/incident-management/incident-response-template/roles-and-staffing.mdx Co-authored-by: Sara Russo <sararusso984@gmail.com> * Update docs/pages/incident-management/incident-response-template/roles-and-staffing.mdx Co-authored-by: Sara Russo <sararusso984@gmail.com> * Update docs/pages/incident-management/incident-response-template/roles-and-staffing.mdx Co-authored-by: Sara Russo <sararusso984@gmail.com> * Update docs/pages/incident-management/incident-response-template/roles-and-staffing.mdx Co-authored-by: Sara Russo <sararusso984@gmail.com> * Update docs/pages/incident-management/incident-response-template/runbooks/build-pipeline-compromise.mdx Co-authored-by: Sara Russo <sararusso984@gmail.com> * Update docs/pages/incident-management/incident-response-template/runbooks/cdn-hosting-compromise.mdx Co-authored-by: Sara Russo <sararusso984@gmail.com> * Update docs/pages/incident-management/incident-response-template/runbooks/ddos-attack.mdx Co-authored-by: Sara Russo <sararusso984@gmail.com> * Remove in-content separators from incident response template --------- Co-authored-by: Sara Russo <sararusso984@gmail.com>
1 parent 0314786 commit ebfce1e

29 files changed

Lines changed: 3182 additions & 1 deletion

‎docs/pages/config/contributors.json‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -551,6 +551,18 @@
551551
"description": "Leading smart contract audit firm specializing in Web3 security solutions, DeFi auditing, and DApp penetration testing.",
552552
"badges": []
553553
},
554+
"hexnickk4997": {
555+
"slug": "hexnickk4997",
556+
"name": "Nick K",
557+
"avatar": "https://avatars.githubusercontent.com/hexnickk4997",
558+
"github": "https://github.com/hexnickk4997",
559+
"twitter": "https://x.com/hexnickk4997",
560+
"website": "https://lido.fi/",
561+
"company": "Lido",
562+
"job_title": null,
563+
"role": "contributor",
564+
"description": "Frameworks Contributor"
565+
},
554566
"smagdali": {
555567
"slug": "smagdali",
556568
"name": "smagdali",

‎docs/pages/incident-management/communication-strategies.mdx‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,9 @@ description: "Establish secure communication channels for incident response. App
44
tags:
55
- Security Specialist
66
- Operations & Strategy
7+
contributors:
8+
- role: wrote
9+
users: [dickson]
710
---
811

912
import { TagList, AttributionList, TagProvider, TagFilter, ContributeFooter } from '../../../components'
@@ -17,7 +20,7 @@ import { TagList, AttributionList, TagProvider, TagFilter, ContributeFooter } fr
1720
<AttributionList contributors={frontmatter.contributors} />
1821

1922
Communication during an incident can be very hard, as people are often scrambling to fix the issue at hand. Nonetheless,
20-
from aa team member, outsider or observer's point of view, communication is very important to be able to understand
23+
from a team member, outsider or observer's point of view, communication is very important to be able to understand
2124
what's happening, and it also provide some time to reflect and think about what is going on. With that said, providing
2225
information before confirming that it's accurate, can often be very negative and cause uncertainty. It is recommended to
2326
have a person designated for communication during an incident, and that updates are sent out on a fixed schedule, and
@@ -37,6 +40,9 @@ responsibilities.
3740
6. Be transparent with external stakeholders about the incident, the impact, and the steps being taken to address it.
3841
Avoid speculation and provide factual information.
3942

43+
For message templates and example public updates, see
44+
[Incident Response Template: Communications](/incident-management/incident-response-template/communications).
45+
4046
---
4147

4248
</TagProvider>

‎docs/pages/incident-management/incident-detection-and-response.mdx‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,9 @@ description: "Detect security incidents early with continuous on-chain monitorin
44
tags:
55
- Security Specialist
66
- Operations & Strategy
7+
contributors:
8+
- role: wrote
9+
users: [dickson]
710
---
811

912
import { TagList, AttributionList, TagProvider, TagFilter, ContributeFooter } from '../../../components'
@@ -37,6 +40,11 @@ incidents.
3740
- **Post-Incident Review**: Conduct a thorough review of the incident to identify lessons learned and improve future
3841
response efforts.
3942

43+
For a complete incident response policy template covering roles, severity, documentation, and response flow, see
44+
[Incident Response Template: Incident Response Policy](/incident-management/incident-response-template/incident-response-policy)
45+
and
46+
[Incident Response Template: Roles and Staffing](/incident-management/incident-response-template/roles-and-staffing).
47+
4048
---
4149

4250
</TagProvider>

‎docs/pages/incident-management/incident-response-template/communications.mdx‎

Lines changed: 202 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,202 @@
1+
---
2+
title: "Communication Templates | Security Alliance"
3+
description: "Templates and building blocks for incident communications. Adapt these to your situation and tone."
4+
tags:
5+
- Security Specialist
6+
- Operations & Strategy
7+
contributors:
8+
- role: wrote
9+
users: [hexnickk4997]
10+
11+
---
12+
13+
import { TagList, AttributionList, TagProvider, TagFilter, ContributeFooter } from '../../../../components'
14+
15+
<TagProvider>
16+
<TagFilter />
17+
18+
# Communication Templates
19+
20+
<TagList tags={frontmatter.tags} />
21+
<AttributionList contributors={frontmatter.contributors} />
22+
23+
Templates and building blocks for incident communications. Adapt these to your situation and tone.
24+
25+
## Before You Post
26+
27+
### Checklist
28+
29+
- [ ] Get approval from Incident Leader or Decision Maker
30+
- [ ] Verify facts are accurate
31+
- [ ] Avoid speculation about root cause (until confirmed)
32+
- [ ] Include what users should do (or not do)
33+
- [ ] State when you'll provide the next update
34+
35+
### What to Include
36+
37+
| Element | When to Include |
38+
|---------|-----------------|
39+
| What happened (high level) | Always |
40+
| User funds are safe | If true |
41+
| What users should do | If action needed |
42+
| What users should NOT do | If relevant (e.g., don't interact with X) |
43+
| What still works | If partial outage |
44+
| When you'll update next | Always |
45+
| Link to status page or thread | If available |
46+
47+
48+
## Building Blocks
49+
50+
Use these as modular pieces. Combine as needed for your situation.
51+
52+
### Acknowledgment
53+
> We're aware of an issue affecting [service/feature] and are actively investigating.
54+
55+
### Funds Safe
56+
> User funds are safe and have not been affected.
57+
58+
### Funds at Risk (be careful)
59+
> We are investigating a potential security issue. Out of caution, we recommend users [specific action].
60+
61+
### Action Required
62+
> If you [specific condition], please [specific action].
63+
64+
### Do Not Interact
65+
> Do not interact with [specific thing] until further notice.
66+
67+
### Service Paused
68+
> We have temporarily paused [service/feature] while we investigate.
69+
70+
### Partial Outage
71+
> [Feature X] is currently unavailable. [Feature Y] and [Feature Z] continue to work normally.
72+
73+
### Timeline Unknown
74+
> We don't have an ETA for resolution yet. We'll provide updates as we learn more.
75+
76+
### Next Update
77+
> We'll provide an update within [timeframe] or sooner if the situation changes.
78+
79+
### Resolution
80+
> The issue has been resolved. [Brief description of what happened and fix].
81+
82+
### Post-Mortem Coming
83+
> We'll publish a detailed post-mortem within [timeframe].
84+
85+
86+
## Example Templates
87+
88+
### Protocol Paused
89+
90+
**For: Twitter/X, Discord announcement**
91+
92+
> We have temporarily paused [protocol/feature] while we investigate a potential issue.
93+
>
94+
> User funds are safe. [OR: We are still assessing the situation.]
95+
>
96+
> Do not interact with [specific contracts/UI] until we confirm the issue is resolved.
97+
>
98+
> We'll provide an update within [1 hour / as soon as we know more].
99+
100+
101+
### Website/Frontend Down
102+
103+
**For: Twitter/X, Discord announcement**
104+
105+
> Our website is currently unavailable. We've taken it offline while we investigate [a potential security issue / technical problems].
106+
>
107+
> Your funds in the protocol are not affected. Do not approve any transactions from sites claiming to be [protocol name] until we confirm service is restored.
108+
>
109+
> Follow this thread for updates.
110+
111+
112+
### Social Account Compromised
113+
114+
**For: Alternate channel (Discord if Twitter compromised, etc.)**
115+
116+
> The [Twitter/Discord/Telegram] account of [person/official account] has been compromised.
117+
>
118+
> Do NOT click any links or interact with messages from that account.
119+
>
120+
> We are working to recover the account. Any legitimate announcements will come from [list alternate verified channels].
121+
>
122+
> If you interacted with any links, revoke token approvals immediately at [revoke.cash or similar].
123+
124+
125+
### Active Exploit (P1)
126+
127+
**For: Initial announcement, keep brief**
128+
129+
> We are aware of a security incident affecting [protocol/feature].
130+
>
131+
> We are actively responding and will share more information as soon as possible.
132+
>
133+
> [If applicable: We have paused affected contracts.]
134+
>
135+
> Do not interact with [specific thing] until further notice.
136+
137+
**For: Follow-up once stabilized**
138+
139+
> Update on the security incident:
140+
>
141+
> [What happened - high level]
142+
> [Current status]
143+
> [What users should do]
144+
> [Funds status - be precise about what was/wasn't affected]
145+
>
146+
> We'll publish a full post-mortem within [timeframe].
147+
148+
149+
### Third-Party Outage
150+
151+
**For: When the issue is not your fault**
152+
153+
> [Feature] is currently unavailable due to an outage at [provider/third-party].
154+
>
155+
> Your funds are safe. This is affecting [what's broken] but [what still works] continues to function normally.
156+
>
157+
> We're monitoring the situation and will restore service when [provider] resolves the issue.
158+
159+
160+
### Issue Resolved
161+
162+
**For: Closing out an incident**
163+
164+
> The issue affecting [service/feature] has been resolved.
165+
>
166+
> [One sentence on what happened]
167+
> [One sentence on the fix]
168+
>
169+
> Thank you for your patience. We'll share a post-mortem with more details within [timeframe].
170+
171+
172+
## Channel-Specific Notes
173+
174+
### Twitter/X
175+
- Keep initial post short
176+
- Use thread for updates
177+
- Pin important updates
178+
179+
### Discord
180+
- Use @everyone or @here sparingly (P1 only)
181+
- Create dedicated thread for ongoing updates
182+
- Lock thread after resolution to preserve record
183+
184+
### Telegram
185+
- Pin critical messages
186+
- Consider disabling chat during active incident to reduce noise
187+
188+
189+
## Tone Guidelines
190+
191+
- Be direct and factual
192+
- Avoid jargon users won't understand
193+
- Don't speculate on root cause until confirmed
194+
- Don't blame (individuals, third parties, users)
195+
- Acknowledge impact on users
196+
- Avoid excessive apologies (one is enough)
197+
198+
*See [Incident Response Policy](./incident-response-policy) for the overall response process.*
199+
200+
201+
</TagProvider>
202+
<ContributeFooter />

0 commit comments

Comments
 (0)