8. Incident Response - WIP
8.1 Purpose
Defines how to identify, contain, and recover from potential network or device security incidents within TheDen Home Network. Focuses on practical response steps using OPNsense, UniFi, and Suricata without centralized monitoring.
8.2 Incident Categories
|
Category |
Description |
Example Indicators |
|
Network Intrusion |
Unauthorized access attempt or unexpected inbound traffic |
Suricata alerts, new device detected |
|
Device Compromise |
IoT or personal device showing unusual behavior |
Non‑U.S. connections, bandwidth spike |
|
Policy Violation |
Device bypassing VLAN or DNS restrictions |
Traffic logs showing cross‑VLAN attempts |
|
Malware/Phishing |
Infected endpoint or malicious download |
Antivirus alert, suspicious domain |
|
Configuration Error |
Change causing unexpected access or outage |
Device unreachable, DNS failure |
8.3 Incident Response Workflow
In the event of a detected or suspected security incident, the following steps are taken:
1. **Detection** – Alert triggered by Suricata or firewall logs.
2. **Containment** – Immediately block or quarantine the affected device using VLAN assignment or MAC filtering.
3. **Investigation** – Review logs to determine traffic patterns, destinations, and scope of exposure.
4. **Eradication** – Reset, re‑image, or replace affected devices as needed.
5. **Recovery** – Verify restored connectivity and confirm normal traffic.
6. **Review** – Document findings in the Incident Log and update rules as necessary.
IPS rule created to update and reload IDS rules (system->settings->cron)
8.4 Detection Methods
- Suricata alerts (Services → Intrusion Detection → Alerts)
- Firewall logs (Firewall → Log Files → Normal View)
- UniFi client list for new or unexpected devices
- ISP or modem logs for bandwidth anomalies
8.5 Immediate Containment
1. Identify the device by hostname, MAC address, or IP.
2. Block traffic:
- In OPNsense: disable DHCP lease or create a temporary block rule.
- In UniFi: block or disconnect the device.
3. Move the device to a quarantine VLAN if available.
4. Record timestamps, IPs, and rule triggers for later review.
8.6 Investigation
Review logs in Suricata and OPNsense to determine the event source, direction, and potential cause. Assess recent firmware or configuration changes for correlation.
8.7 Eradication and Recovery
- **IoT:** Factory reset and reconnect under VLAN 30.
- **Personal Devices:** Perform antivirus scans or OS reinstall.
- **Network Devices:** Restore configuration from backup if misconfiguration suspected.
8.8 Documentation
Maintain an incident log for trend tracking.
|
Date |
Device |
Issue |
Action Taken |
Resolution |
|
2025‑10‑29 |
Smart Plug (IoT) |
Attempted non‑US connection |
Blocked and reset |
Device re‑added successfully |
8.8 Post‑Incident Review
- Verify firewall and IDS rules are correct.
- Identify configuration gaps.
- Update runbook if process improvements are made.
- Add new rules or VLAN restrictions to prevent recurrence.
8.10 Notification
External notification is not required for home-only incidents. If a work or shared account is involved, contact the appropriate administrator immediately.