Resources

Incident Investigation Journal 5 W's Framework

// Document the who, what, when, where, why + how of every security incident

Case Metadata

Case / Ticket #

Date Reported

Date Detected

Analyst Name

Severity

Status

Incident Type

Escalated To

The 5 W's + How

WHO

Who is involved?

WHAT

What happened?

WHEN

When did it occur?

WHERE

Where did it happen?

WHY

Why did it happen?

HOW

How was it executed?

Evidence & IOCs Collected

Containment & Remediation Actions

Containment Steps Taken

Remediation Actions

Lessons Learned & Recommendations

Chain of Custody / Evidence Log

// Track digital evidence handling for investigations and forensic analysis

⚠ Every person who touches evidence must be logged. Gaps in custody can invalidate evidence in legal proceedings.

Case Information

Case Number

Investigator

Department / Agency

Date / Time Opened

Evidence Items

#	Item Description	Type	Hash (SHA256)	Size / Format	Collected By	Date/Time Collected	Location Stored

Transfer / Access Log

Date/Time	Evidence Item #	Released By	Received By	Purpose / Action	Returned?

Certifications

Certifying Officer Name

Certification Date

Certification Statement

Threat Hunting Log

// Document hypothesis-driven hunts across your environment

Hunt Metadata

Hunt ID

Hunter

Start Date

End Date

Hypothesis

Trigger / Intel Source

MITRE Tactic

MITRE Technique

Data Sources & Queries

Data Sources Used

Endpoint logs (EDR / Sysmon)

Network traffic (PCAP / NetFlow)

DNS query logs

Windows Event Logs

Proxy / web gateway logs

Active Directory / LDAP logs

Email gateway logs

Cloud / SaaS audit logs

Threat intel feeds

Queries / SPL / KQL / Sigma Used

Findings

Observations / Anomalies Found

Hunt Outcome

Incident Ticket Created

Detection Gap Identified

Recommended Detections / Follow-up

IOC Tracker — Indicators of Compromise

// Track IPs, domains, hashes, URLs, and other threat indicators

Campaign / Case Reference

Case / Campaign

Threat Actor / Malware Family

Analyst

Last Updated

IOC Table

Type	Indicator	Confidence	TLP	Tags	First Seen	Last Seen	Status	Source

Notes & Context

Penetration Test Planning Template

// Scope, rules of engagement, methodology, and pre-engagement checklist

⚠ LEGAL REMINDER: Obtain signed written authorization before testing. This document does NOT constitute authorization. Never test systems you do not own or have explicit written permission to test.

Engagement Details

Client / Organization

Engagement Type

Start Date

End Date

Lead Tester

Client Point of Contact

Scope — In Scope

Scope — Out of Scope / Exclusions

Rules of Engagement

Written authorization obtained and signed

Emergency stop / abort contact established

Testing hours agreed (e.g. business hours only, or 24/7)

Data handling and confidentiality agreement in place

Notification procedure for critical findings defined

Legal team reviewed and approved engagement

No production data to be exfiltrated during test

Additional Rules / Notes

Methodology / Phases

Phase 1 — Reconnaissance

Phase 2 — Scanning & Enumeration

Phase 3 — Exploitation

Phase 4 — Post-Exploitation

Phase 5 — Reporting

OSINT Collection Worksheet

// Structured open-source intelligence gathering for target reconnaissance

Target & Collection Details

Target Name / Org

Analyst

Collection Date

Classification

Domain & Infrastructure

Domains / Subdomains Found

IP Addresses / CIDR Ranges

DNS Records (MX, NS, TXT, SPF)

Technologies Identified (Shodan/Wappalyzer)

People & Organizational Intel

Key Personnel Found

Email Format Identified

Job Postings (tech stack hints)

Social Media Presence

Leaked Data & Exposures

Have I Been Pwned / Breach Data

Pastebin / GitHub / Code Exposures

Findings Summary

Finding	Severity	Confidence	Source	Notes

Vulnerability Assessment Report

// Document vulnerabilities found, CVSS scores, and remediation priorities

Report Header

Organization

Assessor

Assessment Date

Report Version

Executive Summary

Vulnerability Findings

#	Vulnerability	CVE	CVSS	Severity	Affected System	Remediation	Priority

Attack Surface Mapping Worksheet

// Enumerate all external and internal exposure points for an organization

External Attack Surface

Public IP Ranges / Hosts

Public-Facing Applications

Exposed Services (Shodan/Censys)

Cloud Assets (AWS/Azure/GCP)

Internal Attack Surface

Internal Network Segments

Critical Internal Assets

Human Attack Surface

Employees / User Count

Privileged Accounts

Supply Chain & Third Parties

Threat Actor Profile

// Document known or suspected threat actors using MITRE ATT&CK-aligned intelligence

Actor Overview

Actor Name / Alias(es)

Attribution (Nation / Group)

Threat Level

Active Since

Primary Motivation

Primary Target Sectors

Overview / Description

MITRE ATT&CK TTPs

Known Tactics (e.g. Initial Access, Execution)

Known Techniques (T-numbers)

Known Tools & Infrastructure

Malware / Tools Used

Infrastructure / C2 Patterns

Known IOCs & Detection Opportunities

MITRE ATT&CK Mapping Worksheet

// Map incident or threat actor TTPs to the MITRE ATT&CK framework

Reference

Incident / Campaign

Analyst

Date

Tactic → Technique Mapping

Tactic	Technique ID	Technique Name	Sub-Technique	Evidence / Observations	Detection?

Detection Coverage Gaps

CTF Notes Template

// Capture the Flag challenge documentation — approach, tools, flags, and lessons learned

CTF Event & Challenge Info

CTF Event Name

Challenge Name

Category

Version

Date Started Learning

Official Documentation URL

Installation / Platform

What does this tool do? (in your own words)

Mastery Level

Beginner Expert 20%

Commands Practiced

Command / Syntax	What It Does	Example Use Case	Practiced?

Resources & Next Steps

Resources Used (courses, labs, books)

What to Practice Next

Certification Tracker

// Track your cybersecurity certifications, study progress, and exam prep

My Certifications

Certification	Vendor	Status	Exam Date	Score	Expiry	CEUs / Renewal

Current Study Plan

Target Certification

Target Exam Date

Study Resources

Weekly Study Schedule

Risk Register

// Document, rate, and track organizational security risks and mitigation status

Risk Register

#	Risk Description	Asset / System	Threat	Likelihood (1-5)	Impact (1-5)	Risk Score	Owner	Mitigation	Status

Risk Score = Likelihood × Impact. Score 1-5: Low | 6-10: Medium | 11-15: High | 16-25: Critical

SOC Analyst Shift Handover

// Ensure continuity between SOC shifts — active incidents, open alerts, and priorities

Shift Details

Outgoing Analyst

Incoming Analyst

Shift Start

Shift End

Overall Threat Level During Shift

Active Incidents Requiring Attention

Ticket #	Severity	Description	Status	Next Action	Owner

Alerts Reviewed & Closed This Shift

Total Alerts Received

True Positives

False Positives

Notable False Positive Patterns (for tuning)

Watch Items for Incoming Shift

Tabletop Exercise Notes

// Document tabletop exercise scenarios, team responses, and improvement actions

Exercise Details

Exercise Name

Date

Facilitator

Duration

Participants / Roles

Scenario Description

Inject Log

Time	Inject Description	Team Response	Decision Made	Gap Identified?

After-Action Review

What Went Well

What Needs Improvement

Action Items (with Owners and Deadlines)

tools

tools

curated tools

Nmap

Wireshark

Burp Suite

Metasploit

John the Ripper

Kali Linux

templates

Security analyst Workbook

learning

reference docs & learning

hands-on

practice labs & platforms

TryHackMe

Hack The Box

Blue Team Labs Online

CyberDefenders