IncidentResponsev2

Establish Mission Log Task

Purpose

Create and maintain a detailed Mission Log for all incident response activities to support tracking, reporting, and after-action review.

Standards

• Conduct incident tracking utilizing Date-Time Group (DTG)
• Provide incident description and categorization
• Enumerate discovery and response actions
• Utilize report logs and sanitize for archiving

Procedural Steps (Checklist)

Establish the Mission Log Format

• Determine logging platform (Excel, Google Sheet, Confluence).
• Configure fields:
  • Date/Time
  • Category (using Federal Agency Incident Categories)
  • System/IP
  • Technical Notes
  • Summary
  • Operator (RANK LAST, FIRST)

Train Team on Log Use

• Brief team on required entries and frequency.
• Review 9-Line and Category reference materials.

Record Entries in Real Time

• Log all actions, observations, and communications.
• Use standardized terminology.
• Avoid sensitive or classified information unless authorized.

Consolidate and Archive

• Create daily summaries.
• Sanitize client/victim data.
• Store sanitized versions in CPT archive.

Tools and Resources

Purpose	Tools
Mission log entry	Excel, Confluence
Incident categorization	US CERT Incident Categories

References

• Mission Log template
• Federal Agency Incidents Categories Spreadsheet
• Malware 9-Line Report template

Revision History

Date	Version	Description	Author
2025-05-02	1.1	Expanded with procedural checklist and log format	Leo