DJN2: Incident Response Incident Reporting Template
Incident Reporting
SECTION A: INCIDENT DETAILS
Incident number(s): HDE-1001, HDE-1050, HDE-1072
Incident date(s): 13 DEC 2023
Report author: <012198991>
Report date: 20 JUL 2024
Summary of incident: Multiple users reported slow connections, timeouts, and at
a work stoppage.
Impacted system(s): WIN-6JNN6RLT6IL
Primary function of the Pro-Engineer application for storing and rendering
impacted system(s): engineering files
Impacted user(s): Maya Patel, Diego Martin, Alex Lee
Incident timeline: Dec 13, at 10 AM then at 3:14 PM and 3:20 PM
Functional impact:
(See section: Glossary) ☒HIGH ☐MEDIUM ☐LOW ☐NONE
Incident priority:
☒HIGH ☐MEDIUM ☐LOW
Additional notes: The server has been restarted. Performance issues persist,
and server updates are provided by fake vendor
mailboxes. Abnormal CPU and GPU usage occurs during
working and non-working hours.
Incident type: (check all that apply)
☒Compromised system ☐Lost equipment/theft
☐ Compromised user credentials ☐Physical break-in
(e.g., lost password) ☒Social engineering (e.g., phishing)
☒Network attack (e.g., DoS) ☐Law enforcement request
☒Malware (e.g., virus, worm, Trojan) ☐Policy violation (e.g., acceptable use)
☐ Reconnaissance (e.g., scanning, sniffing) ☐Other: Click or tap here to enter text.
SECTION B: DETECT
PAGE 1
Incident Reporting
SECTION A: INCIDENT DETAILS
Incident number(s): HDE-1001, HDE-1050, HDE-1072
Incident date(s): 13 DEC 2023
Report author: <012198991>
Report date: 20 JUL 2024
Summary of incident: Multiple users reported slow connections, timeouts, and at
a work stoppage.
Impacted system(s): WIN-6JNN6RLT6IL
Primary function of the Pro-Engineer application for storing and rendering
impacted system(s): engineering files
Impacted user(s): Maya Patel, Diego Martin, Alex Lee
Incident timeline: Dec 13, at 10 AM then at 3:14 PM and 3:20 PM
Functional impact:
(See section: Glossary) ☒HIGH ☐MEDIUM ☐LOW ☐NONE
Incident priority:
☒HIGH ☐MEDIUM ☐LOW
Additional notes: The server has been restarted. Performance issues persist,
and server updates are provided by fake vendor
mailboxes. Abnormal CPU and GPU usage occurs during
working and non-working hours.
Incident type: (check all that apply)
☒Compromised system ☐Lost equipment/theft
☐ Compromised user credentials ☐Physical break-in
(e.g., lost password) ☒Social engineering (e.g., phishing)
☒Network attack (e.g., DoS) ☐Law enforcement request
☒Malware (e.g., virus, worm, Trojan) ☐Policy violation (e.g., acceptable use)
☐ Reconnaissance (e.g., scanning, sniffing) ☐Other: Click or tap here to enter text.
SECTION B: DETECT
PAGE 1
