Frameworks, methodology essays, and the foundational thinking on how IR teams should be modelled.
Frode Hommedal's first-principles take on modelling a Computer Security Incident Response Team.
Open →Hommedal's follow-up on tactical IR. Long but worth the time.
Open →AlienVault's complete insider's guide. Practical and accessible.
Open →McAfee Foundstone white paper. Older but still load-bearing for SOC build-outs.
Open →SANS analyst paper on the fight-back side of IR. Detection, containment, recovery.
Open →The OWASP community-driven project on application-layer incident response.
Open →Gabor Szathmari's comprehensive index. Useful starting point for comparison.
Open →Lenny Zeltser's report template for threat intelligence and IR. A practitioner classic.
Open →Six lessons from working in a SOC. Honest practitioner take.
Open →Hands-on references, cheat sheets, and procurement guides. Useful when you are mid-build or mid-response.
The GitHub awesome-list for IR. Tools, books, articles, and references in one curated place.
Open on GitHub →Malware Archaeology's collection of cheat sheets for system configuration and detection.
Open →CREST's procurement guide for cyber security incident response services. Useful when buying retained IR.
Open the PDF →Cybrary's Computer Hacking Forensics Analyst course. Free, online, self-paced.
Open on Cybrary →The open training catalogue. Wide and deep, free.
Open →Richard Bejtlich's foundational essay on what IR actually involves. Older, still load-bearing.
Open →A collection of resources on building and running a SOC for IR and enterprise defensibility.
Open →Open source and free-tier tools that come up regularly in member conversations. None of these are vendor recommendations.
The Seeker of IOC. CERT-W's open source IOC scanner.
Open on GitHub →Tracker of open-source security reports. Large historical dataset.
Open →Firmware analysis service. Useful for IoT and embedded forensics.
Open →Quarkslab's Incident Response Malware Analysis platform. On-prem deployable.
Open →CERT Societe Generale's open source case management for IR teams.
Open on GitHub →Malware analysis service. Free tier suitable for triage.
Open →JavaScript deobfuscation tool. Niche but invaluable when you need it.
Open →Florian Roth's simple IOC and IR scanner. Lightweight, reliable.
Open on GitHub →Malicious traffic detection system. Lightweight network IDS-style tool.
Open on GitHub →Meta/Facebook's threat-sharing platform. Useful for collaborative defence.
Open on GitHub →Team Cymru's malware analysis database. Hash-based lookups.
Open →Got a link that belongs here? Email hello@incidentresponse.com. Submissions are reviewed monthly.
Back to ResourcesCommunity calls coming up, new resources published, and what we're seeing across the membership.
One email a month. Unsubscribe any time. Read our privacy notice.