State of the Practice of Computer Security Incident Response Teams ...

-----BEGIN PGP SIGNED MESSAGE-----
version 5.2, April 2000
CERT(R) Coordination Center
Incident Reporting Form
CERT/CC has developed the following form in an effort to gather incident information.
If you believe you are involved in an incident, we would appreciate your completing
the form below. If you do not believe you are involved in an incident, but have a
question, send email to:
cert@cert.org
Note that our policy is to keep any information specific to your site confidential
unless we receive your permission to release that information.
We would appreciate any feedback or comments you have on this Incident Reporting Form.
Please send your comments to:
cert@cert.org
Submit this form to: cert@cert.org
If you are unable to send email, fax this form to: +1 412 268 6989
Your contact and organizational information
1. name......................:
2. organization name.........:
3. sector type (such as banking, education, energy
or public safety).........:
4. email address.............:
5. telephone number..........:
6. other.....................:
Affected Machine(s)
(duplicate for each host)
7. hostname and IP...........:
8. timezone..................:
9. purpose or function of the host (please be as specific
as possible)..............:
Source(s) of the Attack
(duplicate for each host)
10. hostname or IP...........:
11. timezone.................:
12. been in contact?.........:
13. Estimated cost of handling incident
(if known)...............:
14. Description of the incident (include dates, methods of intrusion, intruder tools
involved, software versions and patch levels, intruder tool output, details of
vulnerabilities exploited, source of attack, or any other relevant information):
Copyright 2003 Carnegie Mellon University
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (GNU/Linux)
Comment: For info see http://www.gnupg.org
iQCVAwUBP410w5Z2NNT/dVAVAQGlCgP/WZlEvbsNW04pRytLssVMEPd4RT7qshxssjtdp5IDFAA4RUnC2UxLGI
HCyqihGawK45XUafD26fulh0yPISxg3Ev5b+4u7lM1GKjVcjtA0jtbW7UfQwBpkaPCJuVyhEOMMLRuWNCUF3Id
FoJfuoFrcQ0tTJ26pUkA
MXrIR2S011U=
=xQHt
-----END PGP SIGNATURE-----
Reprinted with permission from the CERT® Coordination Center. Available at .