Composing the Response: Building an Incident Pipeline from Scratch
summary
Builds a zero‑budget incident pipeline for early‑stage teams (employee #1/#2) that trades improvisation for plumbing: single intake, role-based command, automated war room and enrichment, containment-first actions, plus governance and forensic preservation. Implements auto-create Slack channel, paging and ticketing so an alert hits a ticket with context by minute 2 ticket and enrichment and non‑critical accounts auto‑disabled; host isolation plus snapshot completes by minute 6 snapshot. Uses AI for normalization and investigation assistance but keeps humans for protected assets, legal decisions and evidence handling.
AI-written summary · about
chapters (9)
- 0:00Introduction and welcome
- 1:07Building from scratch
- 4:36Five pillars of response
- 8:29Automating the war room
- 12:44Governance and compliance
- 14:51Maturing the pipeline
- 17:20Manual vs automated response
- 21:55Key takeaways
- 23:22Q&A session
related talks
17mIncident Response @ Scale-Building a Next Generation SOC
15mIncident Ready: Chaos Engineer Your Incident Response
30mHow To Have An Operational Incident (a crash course)
31mFuturistic Luxury Incident Response
34mIncidents Happen
22mHow I Automated Incident Management
44mPanel: Peak Performance Under Pressure: Building Cross-Functional Resilience in Incident Response
29mElevating Open-Source Monitoring Ecosystems