Create Response_template.yaml

Response_template.yaml

@@ -0,0 +1,31 @@
+title: some_name_here
+id: RESPONSE0000
+description: >
+  Some text description here. It will be merged into one line
+author: your name/nickname
+creation_date: YYYY/MM/DD
+severity: M                  # L M H
+tlp: AMBER                   # WHITE GREEN AMBER RED
+tags:
+    - attack.initial_access     # use the next tag scheeme for ATT&CK tags: https://github.com/Neo23x0/sigma/wiki/Tags
+    - attack.t1193              # use the next tag scheeme for ATT&CK tags: https://github.com/Neo23x0/sigma/wiki/Tags
+    - phishinng                 # could be custom tags as well
+references: 
+  - https://example.com
+preparation:
+  - 
+identification:
+  - 
+containment:
+  - # Response Actions could be aggregated 
+  - # 
+eradication:
+  - 
+recovery:
+  - 
+lessons_learned:
+  - 
+workflow: |
+    Description of the workflow in the [Markdown](https://github.com/adam-p/markdown-here/wiki/Markdown-Cheatsheet) format. 
+    You can put here anything you want, i.e. specific conditions/requirements or details on the order of Response Actions execution. 
+    Here newlines will be saved.