Skip to content

PPIVTR-D

PPIVTR-DField manual

/

Overview The lifecycle Decide these before the incident Phase playbooks

P. Preparation I. Identification V and T. Verification and triage R. Response (scope) R. Response (contain) R. Response (eradicate) R. Response (recover) Running the response loop D. Debrief

Templates Metrics Attribution Downloads

Habib Tora · v2.0

Phase playbooks

One page per phase. Each opens with when the phase starts, when it is done, and the record it leaves behind.

PreviousDecide these before the incident NextP. Preparation

Adapts material from Dynamic Incident Response: A Framework for Security Teams by Joshua Wright, © 2026 The Escal Institute of Advanced Technologies, Inc. d/b/a SANS Institute, licensed under CC BY 4.0. Figures reproduced under that license. Changes were made. Not published by, endorsed by, or affiliated with the SANS Institute.