Incident Report Template for Cybersecurity Products
Security incidents in cybersecurity products require specialized reporting: MITRE ATT&CK technique mapping, CVSS scoring, and coordinated disclosure timelines. This template structures incident reports for security teams.
Document incidents with enough detail for post-incident analysis, regulatory reporting, and customer communication.
Template sections
4 sections covering the complete incident report workflow.
Vulnerability Classification
Classify using CVSS 3.1: Attack Vector (Network/Adjacent/Local/Physical), Attack Complexity (Low/High), Privileges Required (None/Low/High), User Interaction (None/Required), Scope (Unchanged/Changed), and Impact (Confidentiality/Integrity/Availability). Calculate the CVSS score to determine severity.
MITRE ATT&CK Mapping
Map the incident to MITRE ATT&CK techniques: Tactic (Initial Access, Execution, Persistence, etc.), Technique ID (T1190, T1059, etc.), and Sub-technique. This mapping helps the team understand the attack pattern and improve detection coverage.
Coordinated Disclosure Timeline
If the vulnerability affects customers or third parties, follow coordinated disclosure: Day 0 — internal discovery, Day 1 — severity assessment and team notification, Day 7 — customer advisory (if customer-impacting), Day 30 — patch available, Day 90 — public disclosure (or earlier if actively exploited).
Root Cause and Remediation
Document: root cause (code defect, configuration error, design flaw), immediate fix (patch, mitigation, workaround), long-term remediation (architecture change, process improvement), and detection improvement (new detection rules, monitoring alerts).
Copy-paste template
## Security Incident Report ### Summary [Incident description] ### CVSS Score - Score: [X.X] ([Critical/High/Medium/Low]) - Vector: [AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H] ### MITRE ATT&CK - Tactic: [Initial Access] - Technique: [T1190 — Exploit Public-Facing Application] ### Timeline | Date | Event | |---|---| | [Date] | Discovered | | [Date] | Severity assessed | | [Date] | Patch deployed | ### Root Cause [Description] ### Remediation - Immediate: [Patch/mitigation] - Long-term: [Architecture change]
Frequently asked questions
Generate instead of filling in templates
Connect your tools, and Vantage generates the content using real product data. Free to start.
Free to start. No credit card required.