ghaymah-exam-waleed-secops/q2-incident-response/incident-report.md

Incident Response & Attack Analysis Report

1. Attack Timeline

• T+00:00 (Reconnaissance): Attacker discovered /api/v1/auth/login endpoint via automated API scanning.
• T+00:10 (Brute Force Execution): Attacker initiated high-velocity credential stuffing from distributed IPs (bypassing basic rate limits).
• T+00:45 (Account Compromise): Successful login on an admin account due to weak password policy and missing MFA.
• T+01:05 (Exfiltration): Unauthorized API access using compromised session JWT to exfiltrate database records.

2. Incident Response Plan (IRP)

1. Containment: Revoke all active JWT tokens, enforce IP-based rate limiting on Ghaymah Ingress, and lock compromised user accounts.
2. Eradication: Block malicious IP ranges via Ghaymah WAF, patch authentication endpoints with MFA, and enforce strong password policies.
3. Recovery: Restore verified state, validate patch integrity, and monitor API traffic for anomaly resurgences over 48 hours.

3. Prevention on Ghaymah Infrastructure

• Network Policies: Deploy rate-limiting rules at Ghaymah Ingress Controller (max 5 failed attempts/min per IP).
• Container Security: Enforce readonly root filesystems and minimal container privileges to restrict lateral movement.