technology software

forum

English

_splunk_rum_sid

OptanonConsent

_gid

is_bot

trackAffiliate

AKA_A2

Domain 'www.splunk.com' uses the commercial generic top-level domain (.com); it also runs on subdomain 'www'. Its registrable label 'splunk' stretches across 6 characters holding 1 vowel versus five consonants. It segments into two words: s, plunk. Expect three characters per word on average. No strong language cues emerged from the frequency lists.

html/a5/57/a55701ad-a576-4504-adaf-432ad4dc9e2d_fallback.html.gz

Incident Response Plans: The Complete Guide To Creating &amp; Maintaining IRPs | Splunk

query

html/a5/57/a55701ad-a576-4504-adaf-432ad4dc9e2d.html.gz

upgrade-insecure-requests; frame-ancestors *.splunk.com *.touchcast.com *.salesforce.com *.cisco.com;

frame-ancestors *.splunk.com *.touchcast.com *.salesforce.com *.cisco.com

script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:225:0

script-src 'unsafe-eval' 'self' 'unsafe-inline' https://www.google.com https://apis.google.com https://ssl.gstatic.com https://www.gstatic.com https://www.googletagmanager.com https://www.google-analytics.com https://*.youtube.com https://*.google.com https://*.gstatic.com https://youtube.com https://www.youtube.com https://google.com https://*.doubleclick.net https://*.googleapis.com https://www.googleadservices.com https://tpc.googlesyndication.com https://www.youtubekids.com https://www.youtube-nocookie.com https://www.youtubeeducation.com https://www-onepick-opensocial.googleusercontent.com;report-uri https://csp.withgoogle.com/csp/youtube_main/allowlist
require-trusted-types-for 'script'

require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes

YouTube video player

Building a World-Class SOC: Incident Management

width=device-width, initial-scale=1, maximum-scale=1

viewport

Need to update your incident response plan? Start here! We’ll show how to create one that works, and how to maintain it for the long haul so it stays effective.

description

FkgQj_Q2EMJDeZ-2L2s3ZUkxjg4IBuH3r22EhfJgsgw

google-site-verification

https://www.splunk.com/en_us/blog/learn/incident-response-plans.html

Incident Response Plans: The Complete Guide To Creating & Maintaining IRPs | Splunk

https://www.splunk.com/content/dam/splunk2/images/customers/derbyshire-fire-and-rescue-service/derbyshire-fire-rescue-customer-full-width-media-right.jpg

twitter:card

twitter:title

twitter:description

twitter:image

twitter:URL

application-name

msapplication-TileColor

/content/dam/splunk2/images/icons/favicons/mstile-144x144.png

msapplication-TileImage

/content/dam/splunk2/images/icons/favicons/mstile-70x70.png

msapplication-square70x70logo

/content/dam/splunk2/images/icons/favicons/mstile-150x150.png

msapplication-square150x150logo

/content/dam/splunk2/images/icons/favicons/mstile-310x150.png

msapplication-wide310x150logo

/content/dam/splunk2/images/icons/favicons/mstile-310x310.png

msapplication-square310x310logo

HSTS header missing - vulnerable to protocol downgrade attacks

CSP header missing - vulnerable to XSS attacks

child-src 'none';object-src 'none';require-trusted-types-for 'script';script-src chrome://resources 'self';trusted-types;worker-src blob: 'self';frame-ancestors 'none';

child-src https:  chrome-untrusted://new-tab-page/ chrome-untrusted://ntp-microsoft-auth/;connect-src chrome://resources chrome://theme 'self';default-src 'self';font-src chrome://resources 'self';img-src chrome://resources chrome://theme chrome://image chrome://favicon2 chrome://app-icon chrome://extension-icon chrome://fileicon blob: data: 'self';object-src 'none';require-trusted-types-for 'script';script-src chrome://resources chrome://webui-test 'self';style-src chrome://resources chrome://theme 'self' 'unsafe-inline';trusted-types parse-html-subset sanitize-inner-html static-types webui-test-script webui-test-html polymer-html-literal polymer-template-event-attribute-policy lit-html-desktop;frame-ancestors 'none';

child-src 'none';object-src 'none';require-trusted-types-for 'script';script-src chrome://resources 'self';trusted-types;frame-ancestors 'none';

base-uri 'none';child-src https:;form-action https://ogs.google.com https://*.corp.google.com;object-src 'none';script-src 'self' 'unsafe-inline' https:;frame-ancestors chrome://new-tab-page/

MarkMonitor Inc.

SPLUNK.COM


// akam-sw.js install script version 1.3.6
"serviceWorker"in navigator&&"find"in[]&&function(){var e=new Promise(function(e){"complete"===document.readyState||!1?e():(window.addEventListener("load",function(){e()}),setTimeout(function(){"complete"!==document.readyState&&e()},1e4))}),n=window.akamServiceWorkerInvoked,r="1.3.6";if(n)aka3pmLog("akam-setup already invoked");else{window.akamServiceWorkerInvoked=!0,window.aka3pmLog=function(){window.akamServiceWorkerDebug&&console.log.apply(console,arguments)};function o(e){(window.BOOMR_mq=window.BOOMR_mq||[]).push(["addVar",{"sm.sw.s":e,"sm.sw.v":r}])}var i="/akam-sw.js",a=new Map;navigator.serviceWorker.addEventListener("message",function(e){var n,r,o=e.data;if(o.isAka3pm)if(o.command){var i=(n=o.command,(r=a.get(n))&&r.length>0?r.shift():null);i&&i(e.data.response)}else if(o.commandToClient)switch(o.commandToClient){case"enableDebug":window.akamServiceWorkerDebug||(window.akamServiceWorkerDebug=!0,aka3pmLog("Setup script debug enabled via service worker message"),v());break;case"boomerangMQ":o.payload&&(window.BOOMR_mq=window.BOOMR_mq||[]).push(o.payload)}aka3pmLog("akam-sw message: "+JSON.stringify(e.data))});var t=function(e){return new Promise(function(n){var r,o;r=e.command,o=n,a.has(r)||a.set(r,[]),a.get(r).push(o),navigator.serviceWorker.controller&&(e.isAka3pm=!0,navigator.serviceWorker.controller.postMessage(e))})},c=function(e){return t({command:"navTiming",navTiming:e})},s=null,m={},d=function(){var e=i;return s&&(e+="?othersw="+encodeURIComponent(s)),function(e,n){return new Promise(function(r,i){aka3pmLog("Registering service worker with URL: "+e),navigator.serviceWorker.register(e,n).then(function(e){aka3pmLog("ServiceWorker registration successful with scope: ",e.scope),r(e),o(1)}).catch(function(e){aka3pmLog("ServiceWorker registration failed: ",e),o(0),i(e)})})}(e,m)},g=navigator.serviceWorker.__proto__.register;if(navigator.serviceWorker.__proto__.register=function(n,r){return n.includes(i)?g.call(this,n,r):(aka3pmLog("Overriding registration of service worker for: "+n),s=new URL(n,window.location.href),m=r,navigator.serviceWorker.controller?new Promise(function(n,r){var o=navigator.serviceWorker.controller.scriptURL;if(o.includes(i)){var a=encodeURIComponent(s);o.includes(a)?(aka3pmLog("Cancelling registration as we already integrate other SW: "+s),navigator.serviceWorker.getRegistration().then(function(e){n(e)})):e.then(function(){aka3pmLog("Unregistering existing 3pm service worker"),navigator.serviceWorker.getRegistration().then(function(e){e.unregister().then(function(){return d()}).then(function(e){n(e)}).catch(function(e){r(e)})})})}else aka3pmLog("Cancelling registration as we already have akam-sw.js installed"),navigator.serviceWorker.getRegistration().then(function(e){n(e)})}):g.call(this,n,r))},navigator.serviceWorker.controller){var u=navigator.serviceWorker.controller.scriptURL;u.includes("/akam-sw.js")||u.includes("/akam-sw-preprod.js")||u.includes("/threepm-sw.js")||(aka3pmLog("Detected existing service worker. Removing and re-adding inside akam-sw.js"),s=new URL(u,window.location.href),e.then(function(){navigator.serviceWorker.getRegistration().then(function(e){m={scope:e.scope},e.unregister(),d()})}))}else e.then(function(){window.akamServiceWorkerPreprod&&(i="/akam-sw-preprod.js"),d()});if(window.performance){var w=window.performance.timing,l=w.responseEnd-w.responseStart;c(l)}e.then(function(){t({command:"pageLoad"})});var k=!1;function v(){window.akamServiceWorkerDebug&&!k&&(k=!0,aka3pmLog("Initializing debug functions at window scope"),window.aka3pmInjectSwPolicy=function(e){return t({command:"updatePolicy",policy:e})},window.aka3pmDisableInjectedPolicy=function(){return t({command:"disableInjectedPolicy"})},window.aka3pmDeleteInjectedPolicy=function(){return t({command:"deleteInjectedPolicy"})},window.aka3pmGetStateAsync=function(){return t({command:"getState"})},window.aka3pmDumpState=function(){aka3pmGetStateAsync().then(function(e){aka3pmLog(JSON.stringify(e,null,"\t"))})},window.aka3pmInjectTiming=function(e){return c(e)},window.aka3pmUpdatePolicyFromNetwork=function(){return t({command:"pullPolicyFromNetwork"})})}v()}}();

 var splunkMeta = {"site":{"language":"en","environment":"prod","siteName":"splunk-blogs"},"page":{"template":"Splunk WWW - Blogs Detail Page Template","blogCategory":"Learn","blogBylineDate":"January 16, 2024","campaignGroup":"N/A","pageOwner":"blog","modifiedDate":"10-16-2025","originalPublishDate":"01-16-2024","urlPath":"https://www.splunk.com/en_us/blog/learn/incident-response-plans.html","productArea":"Security","freeSplunkButton":"/en_us/download.html","containForm":"no","blogAuthorName":"Joseph Nduhiu","blogPromoCard":"NextGen Incident Response","assetType":"N/A"}};


	window.dataLayer = window.dataLayer || [];
    var reactComponents = [];



      (function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':
      new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],
      j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src=
      '//www.googletagmanager.com/gtm.js?id='+i+dl+ '&amp';f.parentNode.insertBefore(j,f);
      })(window,document,'script','dataLayer','GTM-TPV7TP');
   


            var siteConfig= {"loginUrl":"/saml/login","logoutUrl":"/api/bin/sso/logout?module=sso_logout","splunkSubSignUp":"https://www.splunk.com/page/sign_up","eulaCheck":"/bin/splunk/eulaservices","authCheckUrl":"/api/bin/user/info","activityUrl":"/api/bin/user/dlactivity","ajax_sendtoeloqua":"/index.php?module=users&func=ajax_sendtoeloqua","cloudtrial":"/api/bin/product/cloudtrial","calculator":"/bin/splunk/create-calculator","eulaservices":"/api/bin/splunk/eulaservices","ucd_endpoint":"/api/bin/splunk/ucd","contact_endpoint":"/api/bin/lead/contact","location_endpoint":"/api/bin/user/location","user_info_endpoint":"/api/bin/user/info"};
        


    var featureFlagMktoRestEnable = {"mktoRestEnable": true};



    var featureFlagWebApiHostEnable = {"webApiHostEnable": true};



        if(!/^((?!chrome|android).)*safari/i.test(navigator.userAgent)){
           // RUM TRACING:
           SplunkRum.init({
               realm: "us1",
               rumAccessToken: "_eGy6DzWJw7ANofendg4JA",
               applicationName: "WWW-WEBMKT-AEM:splunk-blogs:en_us:NONE:incident-response-plans:blog",
               deploymentEnvironment: "WMD-PROD-PUBLISH"
           });
           // RUM REPLAY:
           SplunkSessionRecorder.init({
               realm: "us1",
               rumAccessToken: "_eGy6DzWJw7ANofendg4JA"
           });
        }
    


            if ( !window.CQ_Analytics ) {
                window.CQ_Analytics = {};
            }
            if ( !CQ_Analytics.TestTarget ) {
                CQ_Analytics.TestTarget = {};
            }
            CQ_Analytics.TestTarget.clientCode = 'splunk';
            CQ_Analytics.TestTarget.currentPagePath = '\/content\/splunk\u002Dblogs\/en_us\/category\/learn\/incident\u002Dresponse\u002Dplans';
        

(window.BOOMR_mq=window.BOOMR_mq||[]).push(["addVar",{"rua.upush":"false","rua.cpush":"true","rua.upre":"false","rua.cpre":"true","rua.uprl":"false","rua.cprl":"false","rua.cprf":"false","rua.trans":"SJ-2820ae46-d91c-464c-ab1e-fa3153852698","rua.cook":"false","rua.ims":"false","rua.ufprl":"false","rua.cfprl":"true","rua.isuxp":"false","rua.texp":"norulematch","rua.ceh":"false","rua.ueh":"false","rua.ieh.st":"0"}]);


			const source = '/etc.clientlibs/splunk/core/clientlibs/clientlib-searchBarReactLib.min.js?v='+Math.floor(Math.random() * 1000);
			
			window.Splunk_app_searchBar = window.Splunk_app_searchBar || {};
			window.Splunk_app_searchBar.searchBarJsSource = source;
			window.Splunk_app_searchBar.renderSplunkSearchBarComponent = renderSplunkSearchBarComponent;
		

An incident response plan is a set of instructions and procedures that an organization follows to detect, respond to, and recover from cybersecurity incidents.

What is an incident response plan?

An incident response plan is important because it helps organizations minimize the impact of security incidents, reduce recovery time and costs, and ensure compliance with regulatory requirements.

Why is an incident response plan important?

Key components of an incident response plan include preparation, identification, containment, eradication, recovery, and lessons learned.

What are the key components of an incident response plan?

Stakeholders from IT, security, legal, communications, and executive leadership should be involved in creating an incident response plan.

Who should be involved in creating an incident response plan?

An incident response plan should be reviewed and updated regularly, especially after incidents, organizational changes, or new threats emerge.

How often should an incident response plan be updated?


				var stickyNavComponentElement = document.querySelector("[data-component-id=StickySideNav-\u002D1480939012]");
				if (stickyNavComponentElement !== null) stickyNavComponentElement.StickyNavComponentScript = new StickyNavComponentScript(stickyNavComponentElement);
		


    var featureFlagRumEnable = {"rumEnable": true};



    CQ_Analytics.TestTarget.maxProfileParams = 11;

    if (CQ_Analytics.CCM) {
        if (CQ_Analytics.CCM.areStoresInitialized) {
            CQ_Analytics.TestTarget.registerMboxUpdateCalls();
        } else {
            CQ_Analytics.CCM.addListener("storesinitialize", function (e) {
                CQ_Analytics.TestTarget.registerMboxUpdateCalls();
            });
        }
    } else {
        // client context not there, still register calls
        CQ_Analytics.TestTarget.registerMboxUpdateCalls();
    }
    

dataLayer.push({prodMapping:[{enterprise:"Splunk Enterprise"},{cloud:"Cloud Trial"},{splunk:"Splunk Enterprise"},{splunk_light:"Splunk Light"},{universalforwarder:"Universal Forwarder"},{cloud_trial:"Cloud Trial"},{es_sandbox:"Enterprise Security Sandbox"},{es_sandbox_private:"Enterprise Security Private Sandbox"},{es_sandbox_beta:"Enterprise Security Beta Sandbox"},{itsi_sandbox:"ITSI Sandbox"},{light_cloud:"Splunk Light Cloud Trial"},{light_trial:"Splunk Light Cloud Trial"}]});

function getIP(a){dataLayer.push({event:"ipEvent",ipAddress:a.ip})};

Google

✅ Low Risk - https://www.splunk.com/en_us/blog/learn/incident-response-plans.html

Requests	IP Address	Location	AS Autonomous System
105	23.36.162.218	Frankfurt am Main, Hesse, Germany	AS20940Akamai International B.V.
23	35.163.74.134	Boardman, Oregon, United States	AS16509AMAZON-02
18	146.75.121.181	Frankfurt am Main, Hesse, Germany	AS54113FASTLY
10	142.250.185.136	United States	AS15169GOOGLE
10	104.18.87.42	United States	AS13335CLOUDFLARENET
8	172.217.18.14	United States	AS15169GOOGLE
3	18.245.31.126	United States	AS16509AMAZON-02
2	142.250.184.206	United States	AS15169GOOGLE
2	142.250.186.131	United States	AS15169GOOGLE
2	142.250.186.118	United States	AS15169GOOGLE
211	141	-	-

Security Scan Report: www.splunk.com

Summary

AI Security Verdict

Details

Screenshot

Page Load Overview

Language Analysis

Primary Language

Detection Details

Website Classification

Primary Category

All Detected Categories

Detected Features

Domain & IP Information

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

ssdeep (Context Triggered Piecewise Hashing)

sdhash (Similarity Digest Hashing)

Image Hashes

Perceptual Hashes

Other Hashes

Scan History