Anthropic-Cybersecurity-Skills/skills/performing-cloud-incident-containment-procedures/assets/template.md

Cloud Incident Containment Report Template

Case Information

Field	Details
Case ID
Cloud Platform(s)	AWS / Azure / GCP
Incident Type
Containment Start
Containment End
IR Lead

Affected Resources

Resource	Type	Account/Subscription	Region	Status

Pre-Containment Evidence

• Disk snapshots created
• Log exports completed
• Configuration state captured
• Network flow logs preserved

Containment Actions Taken

#	Time (UTC)	Action	Resource	Result	Executed By
1

Credential Actions

Identity	Action	Timestamp	Verified
	Keys disabled
	Sessions revoked
	Password reset

Network Isolation

Resource	Previous SG/NSG	Quarantine SG/NSG	Verified

Verification Results

• Compromised resource cannot reach internet
• Compromised credentials are non-functional
• Forensic access still available
• No new unauthorized activity detected

Next Steps

1. Eradication planning
2. Root cause analysis
3. Recovery procedures
4. Post-incident review