Incident Response¶
Generating After Action Reports¶
KSI-INR-AAR
Changelog:
- 2026-05-04: Initial reset for the Consolidated Rules for 2026 Public Preview.
Incident after action reports are generated and lessons learned are persistently incorporated.
Related SP 800-53 Controls: IR-3, IR-4, IR-4.1, IR-8
Terms: Incident, Persistently
Reviewing Incident Response Procedures¶
KSI-INR-RIR
Changelog:
- 2026-05-04: Initial reset for the Consolidated Rules for 2026 Public Preview.
The effectiveness of documented incident response procedures is persistently reviewed.
Related SP 800-53 Controls: IR-4, IR-4.1, IR-6, IR-6.1, IR-6.3, IR-7, IR-7.1, IR-8, IR-8.1, SI-4.5
Terms: Incident, Persistently, Vulnerability Response
Reviewing Past Incidents¶
KSI-INR-RPI
Changelog:
- 2026-05-04: Initial reset for the Consolidated Rules for 2026 Public Preview.
Past incidents are persistently reviewed for patterns or vulnerabilities that were not previously apparent or identified.
Related SP 800-53 Controls: IR-3, IR-4, IR-4.1, IR-5, IR-8
Terms: Incident, Persistently, Vulnerability