AI-Driven Incident Response

Using AI as your co-pilot to detect, contain, eradicate, and recover from security incidents faster and more effectively.

Why AI in Incident Response?

Modern SOCs face alert volumes that overwhelm human analysts. AI transforms IR from a reactive scramble into a structured, accelerated workflow.

• Speed — AI can correlate thousands of log entries in seconds, reducing mean time to detect (MTTD)
• Consistency — AI follows playbooks without fatigue, ensuring no steps are skipped at 3 AM
• Context synthesis — LLMs summarize complex attack chains across multiple data sources simultaneously
• Documentation — AI generates real-time incident timelines, reducing post-incident paperwork by hours
• Knowledge amplification — Junior analysts gain senior-level reasoning through AI-assisted decision support

NIST SP 800-61: The Foundation

NIST Special Publication 800-61 Rev. 2 defines the standard incident response lifecycle used across government and industry.

SANS 6-Step IR Process

The SANS Institute breaks IR into six discrete phases — more granular than NIST, making it ideal for operational playbooks.

1. Preparation — Policies, tools, team training, communication plans
2. Identification — Detect anomalies, validate alerts, determine scope
3. Containment — Short-term and long-term isolation of affected systems
4. Eradication — Remove root cause: malware, backdoors, compromised credentials
5. Recovery — Restore systems, verify integrity, monitor for re-infection
6. Lessons Learned — Post-mortem, documentation, process improvements

Phase 1: Preparation

Effective incident response starts long before the first alert fires. AI accelerates preparation by generating and maintaining IR documentation.

AI-Assisted Preparation Tasks

• Playbook generation — Prompt AI with your infrastructure details to draft IR playbooks for common attack types
• Asset inventory analysis — AI parses CMDB exports to identify critical assets and dependencies
• Tabletop exercise design — AI generates realistic incident scenarios tailored to your environment
• Contact list maintenance — AI cross-references org charts and on-call schedules

# AI-assisted playbook generation prompt
prompt = """Generate an IR playbook for ransomware incidents targeting
our environment:
- 200 Windows endpoints on 10.0.0.0/16
- Active Directory domain: corp.example.com
- Critical assets: SQL Server (10.0.5.10), File Server (10.0.5.20)
- Backup system: Veeam with air-gapped copies

Include: detection signatures, containment steps, eradication
checklist, recovery procedures, and communication templates."""

response = client.messages.create(
    model="claude-sonnet-4-20250514",
    max_tokens=4096,
    messages=[{"role": "user", "content": prompt}]
)

Phase 2: Identification — AI-Powered Triage

The identification phase is where AI delivers the most immediate value: transforming a flood of alerts into actionable intelligence.

Alert Classification Pipeline

def ai_triage_alert(alert_data):
    """Use AI to classify and prioritize a security alert."""
    prompt = f"""Analyze this security alert and provide:
1. Classification (True Positive / False Positive / Needs Investigation)
2. Severity (Critical / High / Medium / Low)
3. Attack category (MITRE ATT&CK technique if applicable)
4. Recommended immediate actions
5. Related IOCs to search for

Alert Data:
{json.dumps(alert_data, indent=2)}

Context: Enterprise network, 500 employees, Windows/Linux mixed env.
Normal business hours: 08:00-18:00 EST."""

    response = client.messages.create(
        model="claude-sonnet-4-20250514",
        max_tokens=1024,
        messages=[{"role": "user", "content": prompt}]
    )
    return parse_triage_response(response.content[0].text)

Severity Assessment Matrix

AI can apply a consistent severity assessment framework to every alert, reducing the variability between analyst shift handoffs.

Real-Time Analysis: Incident Timeline

During an active incident, AI can continuously build and maintain a timeline from multiple log sources. Here is an example of an AI-generated incident timeline:

AI as an IR Co-Pilot: Live Analysis

During an active incident, feed real-time data to AI for continuous analysis and recommendations.

class IRCoPilot:
    """AI-driven incident response co-pilot."""

    def __init__(self, client):
        self.client = client
        self.timeline = []
        self.context = []

    def analyze_event(self, event):
        """Analyze a new event in the context of the ongoing incident."""
        self.timeline.append(event)
        prompt = f"""You are an incident response co-pilot assisting a
SOC analyst during an active security incident.

INCIDENT TIMELINE SO FAR:
{json.dumps(self.timeline, indent=2)}

NEW EVENT:
{json.dumps(event, indent=2)}

Provide:
1. How this event relates to the existing incident timeline
2. Updated threat assessment (escalate/maintain/de-escalate)
3. Immediate recommended actions (be specific with commands)
4. What evidence to collect NOW before it is lost
5. Predicted next attacker actions based on the pattern"""

        response = self.client.messages.create(
            model="claude-sonnet-4-20250514",
            max_tokens=2048,
            messages=[{"role": "user", "content": prompt}]
        )
        return response.content[0].text

Phase 3: Containment Strategies

Containment is about stopping the bleeding. AI helps choose the right containment strategy based on the attack type, affected systems, and business impact.

AI-Assisted Containment Commands

AI generates specific, copy-paste-ready containment commands tailored to the incident context.

Network Isolation

# Isolate compromised host via firewall (iptables)
sudo iptables -I FORWARD -s 10.0.1.42 -j DROP
sudo iptables -I FORWARD -d 10.0.1.42 -j DROP
sudo iptables -I INPUT -s 10.0.1.42 -j DROP

# Allow only IR team access for forensics
sudo iptables -I INPUT -s 10.0.1.42 -d 10.99.0.0/24 -j ACCEPT

# Block C2 domain at DNS level
echo "address=/malicious-c2.example.com/127.0.0.1" >> /etc/dnsmasq.d/ir-blocks.conf
sudo systemctl restart dnsmasq

Account Lockout

# Disable compromised service account in Active Directory
Disable-ADAccount -Identity "svc_backup"

# Force password reset for potentially compromised accounts
Get-ADGroupMember "Domain Admins" | Set-ADUser -ChangePasswordAtLogon $true

# Revoke all active sessions for the compromised user
Revoke-AzureADUserAllRefreshToken -ObjectId (Get-AzureADUser `
    -SearchString "svc_backup").ObjectId

AI Containment Decision Engine

Structure AI recommendations as scored options so the incident commander can make informed decisions quickly.

def recommend_containment(incident_data):
    prompt = f"""Based on this active incident, recommend containment
strategies ranked by effectiveness and business impact.

INCIDENT SUMMARY:
- Type: {incident_data['type']}
- Affected systems: {incident_data['systems']}
- Current spread: {incident_data['spread_status']}
- Business-critical systems at risk: {incident_data['critical_assets']}
- Current business hours: {incident_data['is_business_hours']}

For each option provide:
| Option | Action | Effectiveness | Business Impact | Risk |

Also provide the exact commands/steps to execute each option."""

    response = client.messages.create(
        model="claude-sonnet-4-20250514",
        max_tokens=2048,
        messages=[{"role": "user", "content": prompt}]
    )
    return response.content[0].text

# Example output table from AI:
# | Option | Action                    | Effectiveness | Business Impact | Risk   |
# |--------|---------------------------|---------------|-----------------|--------|
# | 1      | Isolate WS-042 + SRV-DB   | High          | High (DB down)  | Low    |
# | 2      | Block C2 IP at perimeter   | Medium        | None            | Medium |
# | 3      | Disable svc_backup account | High          | Medium          | Low    |
# | RECOMMENDED: Execute options 2 + 3 immediately, option 1 after backup |

Phase 4: Eradication

Eradication removes the root cause of the incident. AI helps ensure nothing is missed by systematically checking for persistence mechanisms.

AI-Driven Eradication Checklist

eradication_prompt = """Given the following incident details, generate
a comprehensive eradication checklist:

Attack type: Credential theft + lateral movement
Compromised accounts: svc_backup, jsmith
Malware found: Mimikatz (memory-resident), Cobalt Strike beacon
Affected systems: WS-042, SRV-DB-01
C2 infrastructure: 185.220.101.0/24

For each item, provide:
- Specific check to perform
- Command or tool to use
- How to verify successful eradication
- Common places attackers hide persistence"""

Common Persistence Locations to Check

• Scheduled Tasks — schtasks /query /fo LIST /v
• Registry Run keys — reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
• WMI subscriptions — Get-WMIObject -Namespace root\subscription -Class __EventFilter
• Services — Get-Service | Where-Object {$_.StartType -eq 'Automatic'}
• SSH authorized_keys — find / -name authorized_keys -type f 2>/dev/null

Phase 5: Recovery

Recovery restores affected systems to normal operation. AI assists with verification procedures and monitoring for re-infection.

AI-Assisted Recovery Workflow

1. System restoration — Rebuild from known-good images or restore from verified backups
2. Credential rotation — AI generates a comprehensive list of credentials to reset based on blast radius analysis
3. Integrity verification — Compare file hashes against known-good baselines
4. Monitoring enhancement — AI generates custom detection rules for re-infection indicators
5. Staged reconnection — Bring systems back online incrementally with enhanced monitoring

# AI-generated YARA rule for post-recovery monitoring
recovery_prompt = """Based on the IOCs from this incident, generate:
1. YARA rules to detect the malware variants observed
2. Sigma rules for the behavioral patterns identified
3. Network signatures (Snort/Suricata) for C2 communication
4. A 30-day enhanced monitoring plan

IOCs:
- File hash: a1b2c3d4e5f6... (Cobalt Strike beacon)
- C2 domains: update.legit-software[.]com, cdn.trusted-host[.]net
- User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT)
- Named pipe: \\.\pipe\msse-1234-server"""

Evidence Collection & Chain of Custody

Proper evidence handling can make or break a legal case. AI helps document everything meticulously while analysts focus on technical collection.

AI-Documented Evidence Log

Evidence Collection Commands

AI provides the exact forensic collection commands and automatically documents each step with timestamps and hashes.

Volatile Evidence (Collect First!)

# Memory acquisition (Linux)
sudo dd if=/dev/mem of=/evidence/mem_dump_$(hostname)_$(date +%s).raw
sha256sum /evidence/mem_dump_*.raw >> /evidence/hashes.txt

# Network connections snapshot
ss -tunapeo > /evidence/netstat_$(date +%s).txt
ip route show > /evidence/routes_$(date +%s).txt

# Running processes with full details
ps auxef > /evidence/processes_$(date +%s).txt
ls -la /proc/*/exe 2>/dev/null > /evidence/proc_links_$(date +%s).txt

Disk Evidence

# Create forensic disk image with hash verification
sudo dc3dd if=/dev/sda of=/evidence/disk_image.dd \
    hash=sha256 log=/evidence/dc3dd_log.txt

# Verify image integrity
sha256sum /evidence/disk_image.dd
# Compare against dc3dd output hash

Communication Templates: Stakeholder Notifications

AI drafts communication at each stage of the incident, ensuring consistent, professional messaging tailored to each audience.

Initial Notification (Technical Team)

Communication Templates: Executive & Legal

Executive Briefing (AI-Drafted)

Legal / Compliance Notification

AI-Assisted Communication Generator

def generate_ir_communication(incident, audience, phase):
    """Generate audience-appropriate incident communications."""
    prompt = f"""Draft an incident response communication for:

Audience: {audience}  # "technical", "executive", "legal", "customers"
IR Phase: {phase}     # "detection", "containment", "eradication", "recovery"

Incident Details:
- ID: {incident['id']}
- Type: {incident['type']}
- Severity: {incident['severity']}
- Affected systems: {incident['systems']}
- Data at risk: {incident['data_types']}
- Current status: {incident['status']}
- Business impact: {incident['business_impact']}

Guidelines:
- Technical audience: Include IOCs, affected systems, required actions
- Executive audience: Focus on business impact, timeline, decisions needed
- Legal audience: Include data types, jurisdictions, regulatory deadlines
- Customer audience: Transparent but measured, include protective steps

Use professional tone. Do not speculate beyond confirmed facts.
Include a "Next Update" timestamp."""

    response = client.messages.create(
        model="claude-sonnet-4-20250514",
        max_tokens=1024,
        messages=[{"role": "user", "content": prompt}]
    )
    return response.content[0].text

Phase 6: Lessons Learned

The most frequently skipped IR phase is also the most valuable. AI ensures thorough post-incident analysis by structuring the review process.

AI-Driven Root Cause Analysis

rca_prompt = """Perform a root cause analysis for this security incident.
Use the "5 Whys" technique and provide a fishbone (Ishikawa) diagram
structure.

INCIDENT TIMELINE:
{full_timeline}

ATTACK CHAIN:
1. Phishing email delivered to jsmith@corp.example.com
2. User clicked link, downloaded malicious macro document
3. Macro executed PowerShell downloader
4. Cobalt Strike beacon established C2 channel
5. Mimikatz extracted svc_backup credentials from memory
6. Lateral movement to SRV-DB-01 via SMB
7. Database export and exfiltration via HTTPS to external IP

Provide:
- Root cause identification (technical and process failures)
- Contributing factors
- Specific, actionable recommendations with priority
- Metrics to track improvement
- Detection gaps that allowed each step"""

Root Cause Analysis: 5 Whys Example

AI applies structured analytical frameworks to produce actionable findings from incident data.

Lessons Learned Documentation

AI generates comprehensive post-incident reports that capture institutional knowledge and drive security improvements.

lessons_prompt = """Generate a Lessons Learned report for incident
IR-2024-042 using this structure:

1. EXECUTIVE SUMMARY (3-4 sentences)
2. INCIDENT METRICS
   - Time to detect (TTD)
   - Time to contain (TTC)
   - Time to eradicate (TTE)
   - Time to recover (TTR)
   - Total incident duration
3. WHAT WENT WELL
4. WHAT NEEDS IMPROVEMENT
5. ACTION ITEMS (owner, priority, deadline)
6. DETECTION GAP ANALYSIS
7. UPDATED RISK ASSESSMENT

Incident data: {incident_full_record}
Timeline: {incident_timeline}
Team feedback: {team_survey_responses}

Format as a professional report suitable for CISO review."""

Building IR Runbooks with AI

IR runbooks are step-by-step procedures for specific incident types. AI can generate, maintain, and improve runbooks based on lessons learned from actual incidents.

Runbook Structure

runbook:
  name: "Ransomware Response"
  version: 2.3
  last_updated: "2024-11-15"
  author: "IR Team + AI Assistant"
  severity_default: "Critical"

  triggers:
    - "EDR alert: ransomware behavior detected"
    - "Multiple file extension changes in short period"
    - "Ransom note file detected (README.txt, DECRYPT_FILES.html)"

  immediate_actions:
    - step: "Isolate affected system from network"
      command: "netsh advfirewall set allprofiles state on"
      timeout: "30 seconds"
      escalate_if_fails: true

    - step: "Identify ransomware variant"
      tool: "Upload sample to VirusTotal / ID Ransomware"
      ai_assist: "Analyze ransom note and file extensions for variant ID"

    - step: "Check for lateral spread indicators"
      command: "Get-ADComputer -Filter * | Test-Connection -Count 1"
      ai_assist: "Query SIEM for similar IOCs on other endpoints"

  containment:
    - step: "Block C2 at perimeter firewall"
    - step: "Disable affected user accounts"
    - step: "Snapshot affected VMs before further action"

AI Runbook Generator

def generate_runbook(incident_type, environment):
    """Generate a tailored IR runbook for a specific incident type."""
    prompt = f"""Create a detailed IR runbook for: {incident_type}

Environment context:
{json.dumps(environment, indent=2)}

The runbook must include:
1. TRIGGERS - What alerts/events activate this runbook
2. SEVERITY CLASSIFICATION - How to determine initial severity
3. IMMEDIATE ACTIONS (first 15 minutes)
4. INVESTIGATION STEPS (with specific commands for our OS mix)
5. CONTAINMENT OPTIONS (ranked by impact)
6. ERADICATION CHECKLIST
7. RECOVERY PROCEDURES
8. COMMUNICATION TEMPLATES (by audience)
9. EVIDENCE COLLECTION REQUIREMENTS
10. POST-INCIDENT TASKS

For each step provide:
- Description of what to do and why
- Exact command(s) to execute
- Expected output / success criteria
- What to do if the step fails
- Escalation criteria

Format as YAML for integration with our SOAR platform."""

    response = client.messages.create(
        model="claude-sonnet-4-20250514",
        max_tokens=4096,
        messages=[{"role": "user", "content": prompt}]
    )
    return response.content[0].text

Runbook Library: Common Incident Types

Build a library of AI-generated runbooks covering your most common and most critical incident types.

Integrating AI into Your IR Workflow

Practical architecture for embedding AI into your existing incident response tools and processes.

Integration Points

• SIEM → AI — Forward high-fidelity alerts for AI triage and enrichment
• SOAR → AI — AI generates containment playbook steps, SOAR orchestrates execution
• Ticketing → AI — AI updates incident tickets with analysis, timeline entries, and status changes
• Chat/Bridge → AI — AI bot on the IR bridge provides real-time analysis and answers questions
• Evidence Platform → AI — AI maintains chain of custody logs and generates forensic reports

IR Playbook Snippet: Phishing Response

A condensed example of an AI-generated IR playbook for a phishing incident with credential compromise.

playbook: phishing_credential_compromise
phase: identification
steps:
  - action: "Extract IOCs from reported phishing email"
    ai_prompt: |
      Analyze this email header and body. Extract:
      - Sender IP and domain (check SPF/DKIM/DMARC)
      - All URLs (defang them)
      - Attachment hashes
      - Social engineering technique used
    output: ioc_list

  - action: "Search for other recipients"
    command: |
      # Exchange Online
      Get-MessageTrace -SenderAddress "phish@evil.com" \
        -StartDate (Get-Date).AddDays(-7) -EndDate (Get-Date)
    ai_assist: "Analyze results to determine campaign scope"

  - action: "Check for credential submission"
    command: |
      # Search proxy logs for phishing URL access
      grep -i "evil-login-page.com" /var/log/proxy/access.log
    ai_assist: "Identify users who visited the credential harvesting page"

  - action: "Determine which users submitted credentials"
    ai_prompt: |
      Given proxy logs showing these users visited the phishing URL,
      analyze POST request sizes to determine who likely submitted
      credentials vs. who just loaded the page.

Handling AI Limitations in IR

AI is a powerful tool but has critical limitations that must be understood during incident response.

CTF Challenge: Active Incident Response

You are the on-call SOC analyst. An active security incident has been detected. Use AI-assisted IR techniques to respond.

CTF Challenge: Your Mission

Tasks

1. Identification — Use AI to analyze the alert data. Classify the incident type, determine severity, and map to MITRE ATT&CK techniques
2. Timeline — Construct a detailed incident timeline from the provided log data using AI assistance
3. Containment — Propose and justify at least 3 containment actions with exact commands. Rank them by priority
4. Evidence — List all evidence to collect, in order of volatility. Provide collection commands and chain-of-custody entries
5. Communication — Draft notifications for: (a) the IR team, (b) the CISO, and (c) the affected user's manager
6. Eradication Plan — Detail how you would eradicate the threat, including persistence mechanism checks
7. Lessons Learned — Write a preliminary post-incident report with root cause hypothesis and 3 improvement recommendations

CTF Hint: MITRE ATT&CK Mapping

Map each observed behavior to MITRE ATT&CK techniques to understand the full attack chain.

Key Takeaways

• IR frameworks provide structure — NIST SP 800-61 and SANS 6-step processes ensure no phase is skipped, even under pressure
• AI excels at triage speed — Automated alert classification and severity scoring reduce MTTD from hours to minutes
• Containment requires human judgment — AI recommends actions; humans authorize them based on business context
• Evidence integrity is non-negotiable — AI documentation ensures chain of custody is maintained even during chaotic incidents
• Communication is an IR skill — AI drafts audience-appropriate notifications so analysts can focus on technical response
• Runbooks capture knowledge — AI-generated runbooks encode lessons learned into repeatable, testable procedures
• Post-incident analysis drives improvement — AI-powered root cause analysis and lessons learned create a continuous improvement cycle