In my company, after a DDOS against a server, my employer asked me to make an analysis of the attack and to write down some stuff.

What do you think I need to write down in my report?
Is there any available template from a CIRT or another organization that can be used after an incident?
What is the best practice about this kind of report?

In my first analysis i found where the attack was planned (an IRC channel).
I found information about the tool used and the url where the tool can be downloaded.
The attack is made with a LOIC and not with any kind of botnet (as I actually know).
The attack was planned without a hierarchical organization but was organized and maded with the help of people recruited hand-to-hand with the sharing of a little manifesto and the sharing through IRC and twitter of a JPG containing the information on the target and the time of the attack.
I need also to write down some stuff about the people around this attack?

any suggestion?

PLEASE: one-suggestion one-answer, so we can have a community best practice at the end :)

  • I think a useful field would be total down time and also cost estimates of missed orders and repair costs.
    – user8161
    Mar 2, 2012 at 0:17

1 Answer 1


Sorry not to have a good link, but my thought is you want to cover:

What happened?

  • When did it happen, and for how long did it continue?
  • Who did it and how?
  • What was affected - what sites, what servers, how many servers, what part of the business? What customers?
  • Root Cause Analysis

What was the impact?

  • Damage to servers
  • Damage/exposure of information
  • Damage to corporate reputation
  • Damage to human life (crossing fingers that this is a definite no!!!)
  • Cost of Recovery (Time, Equipment, etc.)


  • What has been done so far? Break it down into immediate response vs. ongoing updates
  • What else should be done?
  • What is the projection for this happening again?
  • What about something like this, but not exactly the same?
  • Are there any changes we could make to future process to prevent/mitigate this type of risk?

Break into past/present/future - what did we do immediate, what are we doing now, what are the big things we should do in the future that will require high level funding?

Future Prognosis

  • If we do everything in the report what is the likely state of the system to future attacks. Probably not "bulletproof", so give some assessment of likelihood.
  • How about if we just leave the system in it's current (partially fixed?) state?
  • 2
    +1, I would also add root cause analysis, and also under impact - time personnel spent cleaning up the mess...
    – AviD
    Mar 9, 2011 at 9:37
  • @Avid - Thanks, good call, I made the update in the answer. Mar 9, 2011 at 18:38
  • well, then, I'd +1 you again, if I could... ;-)
    – AviD
    Mar 9, 2011 at 18:40
  • @Autocracy karma comes around
    – AviD
    Mar 9, 2011 at 18:51
  • @bethlakshmi: thanks for the good answer. Right now I found a guidelines from NIST about incident response after DDOS. An answer from myself come soon, i hope.
    – boos
    Mar 10, 2011 at 23:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .