Incident documentation in Cybersecurity - Mini Project: Build & Apply

Incident Documentation

📖 Scenario: You work in a cybersecurity team responsible for tracking security incidents in your organization. Proper documentation helps your team understand what happened, how it was handled, and how to prevent it in the future.

🎯 Goal: Create a clear and organized incident documentation record using a dictionary to store incident details, add a status variable, summarize the incident with a loop, and finalize the report with a conclusion note.

📋 What You'll Learn

Create a dictionary named incident_report with exact keys and values for incident details

Add a variable named status to indicate the current state of the incident

Use a for loop with variables key and value to iterate over incident_report.items() and build a summary list

Add a final key-value pair 'Conclusion': 'Incident resolved and documented' to incident_report

💡 Why This Matters

🌍 Real World

Incident documentation is essential in cybersecurity to keep clear records of security events, helping teams analyze and improve defenses.

💼 Career

Cybersecurity analysts and incident responders regularly document incidents to communicate findings and support audits and compliance.

1

Create the initial incident report dictionary

Create a dictionary called incident_report with these exact entries: 'Incident ID': 'INC12345', 'Date': '2024-06-01', 'Type': 'Phishing Attack', 'Detected By': 'Email Filter', and 'Severity': 'High'.

Cybersecurity

# Create the incident_report dictionary with given details
# Your code here

Need a hint?

Use curly braces {} to create the dictionary and separate each key-value pair with commas.

2

Add a status variable

Add a variable called status and set it to the string 'Open' to indicate the incident is currently active.

Cybersecurity

incident_report = {
    'Incident ID': 'INC12345',
    'Date': '2024-06-01',
    'Type': 'Phishing Attack',
    'Detected By': 'Email Filter',
    'Severity': 'High'
}
# Add the status variable below
# Your code here

Need a hint?

Assign the string 'Open' to the variable status.

3

Summarize the incident details

Use a for loop with variables key and value to iterate over incident_report.items(). Inside the loop, create a list called summary and append strings in the format "key: value" for each item.

Cybersecurity

incident_report = {
    'Incident ID': 'INC12345',
    'Date': '2024-06-01',
    'Type': 'Phishing Attack',
    'Detected By': 'Email Filter',
    'Severity': 'High'
}
status = 'Open'
summary = []
# Use a for loop to add 'key: value' strings to summary
# Your code here

Need a hint?

Use for key, value in incident_report.items(): and inside the loop append formatted strings to summary.

4

Add the conclusion to the incident report

Add a new key-value pair to incident_report with key 'Conclusion' and value 'Incident resolved and documented'.

Cybersecurity

incident_report = {
    'Incident ID': 'INC12345',
    'Date': '2024-06-01',
    'Type': 'Phishing Attack',
    'Detected By': 'Email Filter',
    'Severity': 'High'
}
status = 'Open'
summary = []
for key, value in incident_report.items():
    summary.append(f"{key}: {value}")
# Add the conclusion key-value pair below
# Your code here

Need a hint?

Use incident_report['Conclusion'] = 'Incident resolved and documented' to add the final note.