Run Security Incident Response Workspace — Free

Members

Yes No N/A

Channels

incident-response

Primary coordination channel for live incident updates, status changes, and DRI-led actions.

Yes No N/A

incident-decisions

Channel for approval-sensitive decisions, executive updates, and documented response calls.

Yes No N/A

incident-evidence

Private channel for evidence handling, forensic notes, indicators of compromise, and chain-of-custody updates.

Yes No N/A

incident-retrospective

Channel for lessons learned, root cause themes, and corrective action planning after containment.

Yes No N/A

Check ins

Hourly incident status check-in

Yes No N/A

Daily leadership update

Yes No N/A

Weekly lessons learned review

Yes No N/A

Milestones

Incident detected and response opened

Initial alert validated and response workspace activated.

Yes No N/A

Severity confirmed and containment underway

Impact assessed and immediate containment actions started.

Yes No N/A

Notifications completed

Required internal and external notifications sent or approved.

Yes No N/A

Recovery validated

Systems restored and enhanced monitoring in place.

Yes No N/A

Lessons learned review completed

Post-incident review held and corrective actions assigned.

Yes No N/A

Task lists

Triage and Severity Assessment

Establish incident scope, classify severity, and identify affected systems, identities, and data.

Yes No N/A

Containment and Eradication

Track immediate containment steps, access controls, and remediation actions to stop spread and remove the threat.

Yes No N/A

Notifications and Stakeholder Updates

Manage internal and external notifications, approvals, and communication records.

Yes No N/A

Recovery and Lessons Learned

Restore services, capture root cause themes, and convert findings into corrective actions.

Yes No N/A

Hill charts

Security Incident Response Progress

Tracks the major response workstreams from detection through recovery.

Yes No N/A

Default apps

Yes No N/A

Integrations

Slack

Yes No N/A

PagerDuty

Yes No N/A

Jira

Yes No N/A

Google Drive

Yes No N/A

SIEM

Yes No N/A

Pinned resources

Incident Response Runbook

Yes No N/A

Severity Classification Matrix

Yes No N/A

Notification and Escalation Contacts

Yes No N/A

Evidence Handling and Chain of Custody Guide

Yes No N/A

Post-Incident Review Template

Yes No N/A

Get your results

Enter your email — we'll send you a PDF of your filled-out template. We won't sign you up to anything; you can opt in to the trial from the email if you want.

Email (required)

Your name (optional)

Run: Security Incident Response Workspace

Members

Channels

Check ins

Milestones

Task lists

Hill charts

Default apps

Integrations

Pinned resources

Get your results