RESPONDER LIBRARY

Resources & References

Frameworks, tools, field notes, and reusable artifacts for incident detection and response.

Last reviewed: July 17, 2026

REFERENCE

Frameworks and operating models

Use these to structure governance, preparation, execution, and post-incident improvement.

NIST SP 800-61 Rev. 3

Current incident-response recommendations aligned to the six functions of NIST CSF 2.0. Rev. 3 supersedes Rev. 2.

MITRE ATT&CK

Adversary tactics and techniques for investigation scoping, detection coverage, and purple-team validation.

ATT&CK Navigator

Layer-based mapping for observed behavior, detection coverage, and response priorities.

Additional NIST technical references
ENGINEERING

Detection engineering

Represent behavior as portable logic, test it against real telemetry, and track coverage.

Detection content and analysis resources
ResourceOperational useDeploymentAccess
SigmaPortable detection rules and backend translationRepository / pipelineOpen source
YARAFile and memory pattern matchingHost / analysis pipelineOpen source
KQLTelemetry hunting, correlation, and analyticsMicrosoft security servicesCommercial platform
Elastic detection rulesVersioned detection logic and unit testsElastic SecurityOpen repository
ATT&CK NavigatorCoverage, gap, and incident-behavior mappingBrowser / local deploymentOpen source
INVESTIGATION

Endpoint and identity

Correlate process, persistence, session, credential, and directory activity before isolating assets or disabling identities.

Endpoint and identity investigation platforms
ResourceOperational useDeploymentData-handling note
Microsoft Defender for EndpointEndpoint detection, advanced hunting, investigation, and live responseSaaS / endpoint sensorTenant-controlled telemetry; validate retention
CrowdStrike FalconEndpoint detection, investigation, containment, and real-time responseSaaS / endpoint sensorCloud telemetry; validate regional and retention requirements
Microsoft Entra ID ProtectionRisky user, sign-in, and identity investigationSaaSCorrelate risk events with audit and endpoint evidence
Microsoft Defender for IdentityHybrid identity detection and lateral-movement investigationSaaS / directory sensorsPreserve directory and authentication logs
BloodHound Community EditionIdentity attack-path analysisSelf-hostedGraph data is highly sensitive; restrict access
TELEMETRY

Network, cloud, SaaS, and containers

Collect control-plane, identity, workload, packet, and application evidence as a single incident timeline.

Network

  • Wireshark — packet-level inspection; captures may contain credentials and regulated data.
  • Zeek — structured network metadata and protocol analysis.
  • Suricata — IDS/IPS, protocol logging, and rule-based detection.

Cloud and SaaS

Containers and Kubernetes

  • Microsoft Defender for Containers — multicloud Kubernetes posture, image vulnerability assessment, and runtime threat protection.
  • Falco — runtime detection using kernel and Kubernetes signals.
  • Trivy — image, filesystem, configuration, and SBOM assessment.
  • Kubernetes audit logs — API activity and control-plane evidence.
EVIDENCE

Forensics and evidence collection

Use targeted triage first, then escalate to full acquisition when scope, legal hold, or investigative depth requires it.

Collection and forensic analysis tools
ToolOperational useDeploymentAccess
VelociraptorFleet-scale endpoint triage, artifact collection, and huntingSelf-hosted / endpoint clientOpen source
KAPETargeted Windows triage and artifact processingResponder workstationFree
FTK ImagerDisk imaging and forensic acquisitionResponder workstationFree
Autopsy / Sleuth KitDisk, filesystem, and artifact analysisAnalyst workstationOpen source
Volatility 3Memory-image analysisAnalyst workstationOpen source
X-Ways ForensicsDisk, filesystem, memory, and case analysisAnalyst workstationCommercial

Evidence discipline

Record the source, collector, UTC timestamps, acquisition method, tool version, cryptographic hash, storage location, and every transfer. Avoid changing system state unless the response decision justifies it and the action is recorded.

ANALYSIS

Malware analysis

Separate initial classification, dynamic behavior, and reverse engineering. Never treat a single scanner verdict as conclusive.

Public-service handling warning

Before submitting a file, URL, packet capture, document, or indicator to a public analysis service, confirm the organization’s data-handling policy. Public or community submissions may become accessible to vendors, researchers, or other service users. Use private analysis, contractual controls, or an isolated internal sandbox for sensitive material.

  • VirusTotal — multi-engine enrichment and relationship analysis; submission visibility depends on service and license.
  • ANY.RUN — interactive dynamic analysis; verify privacy mode before uploading.
  • capa — identifies executable capabilities from static or dynamic evidence.
  • Ghidra and IDA Pro — disassembly and reverse engineering.
  • CAPE Sandbox — self-hosted automated malware analysis and configuration extraction.
INTELLIGENCE

Threat intelligence and sharing

Use intelligence to add context and prioritize decisions—not as a substitute for evidence from the affected environment.

Open intelligence

TEMPLATES

Responder field kit

Plain Markdown artifacts designed for quick adaptation during preparation or an active incident.

Incident severity matrixImpact, scope, confidence, and escalation criteria Initial incident checklistFirst-hour validation, preservation, and coordination Evidence and chain of custodyCollection, hashes, storage, and transfers Ransomware containment matrixDecision authority, blast radius, and action windows Cloud evidence checklistIdentity, control plane, workload, network, and SaaS logs Identity investigation worksheetSessions, credentials, privilege, and persistence Executive status updateKnown facts, business impact, decisions, and next update Post-incident reviewTimeline, control gaps, ownership, and validation AI incident evidence checklistInstructions, models, traces, tools, retrieval, identity, and downstream actions Repository-compromise checklistGit, workflows, identities, dependencies, artifacts, and trusted recovery
DEVELOPMENT

Training, certifications, and community

Prioritize hands-on investigation, evidence interpretation, reporting, and decision-making over credential collecting.

Role-aligned certifications

  • GCIH — incident handling.
  • GCFA — enterprise forensics and response.
  • GREM — malware reverse engineering.
  • SC-200 — Microsoft security operations.
  • ECIH — incident handling.
  • CHFI — digital forensics.

Working communities

COORDINATION

Legal, regulatory, and external reporting

Notification duties depend on jurisdiction, sector, contract, data type, and materiality. Engage counsel and privacy leadership early; do not infer reporting clocks from a generic checklist.

READING

Technical reading

A mix of durable references and continuously updated field research.

Books

  • Incident Response & Computer Forensics — Luttgens, Pepe, and Mandia
  • The Art of Memory Forensics — Case, Levy, Walters, and Richard
  • Digital Forensics and Incident Response — Gerald Johansen
  • Intelligence-Driven Incident Response — Roberts and Brown