主题： incident-response
-
秘密已被提交：为什么只删文件不够，以及响应顺序是什么
推送到 Git 仓库的凭据会留在历史、分叉、克隆、缓存和 CI 日志中。重写历史可减少后续暴露，却无法收回副本，因此第一步是撤销并轮换凭据，然后清理历史，再检查使用情况。
-
Cisco Secure Email Gateway 与 SD-WAN Manager：核实修复并保全入侵证据
为邮件扫描器和 SD-WAN Manager 分别建立修复记录。核实实际安装的修复版本，在会中断运行的恢复操作之前保全证据，并按照各产品专用的调查流程处理。
-
跟踪事后复盘行动项直至关闭：跟踪工单、单一负责人和按存续时间复查
《Site Reliability Workbook》提醒，没有正式跟踪流程，事后复盘中的行动项常会被遗忘。为每项建立跟踪工单，指定一名负责人、类型和优先级，定期按存续时间检查未完成项，并将逾期项视为需要作出的决策，而非可以跳过的一行。
-
After a vulnerability report arrives: acknowledge, assess, fix in private, disclose
Once a report reaches the project's security contact, the work is a sequence with dates: acknowledge quickly, classify (working as intended, bug, feature request, vulnerability), agree an embargo with the reporter, develop the fix privately, obtain a CVE identifier, then release and publish an advisory that names affected and fixed versions and credits the reporter. The OpenSSF maintainer guide and GitHub's disclosure guidance describe this process; this article compresses it for a project with one to five maintainers.
-
为遭漏洞利用的边缘设备打补丁后：证据保全、恢复及重新上线检查
本文提出一套运维流程，用于调查曾暴露于已遭利用漏洞的边缘设备：保全证据，记录是否需要按厂商指引重建，更换已暴露的信任材料，并将恢复验证与补丁安装验证分开进行。
-
存有 API 密钥的服务商遭入侵后：遏制风险、更换密钥与核查账单
在签发方撤销已暴露的密钥，通过可信系统恢复合法使用方的访问，并调查用量和费用。预算告警与替换密钥的交付是两项独立控制措施，都需要验证。
-
Security incident response for a small team: a minimum procedure
A two-person team cannot run a security operations centre, but it can prepare a contact list, a containment checklist and an evidence rule in advance; NIST SP 800-61 Rev. 3 frames incident response as part of ongoing risk management, and this procedure is the minimum that makes the first hour predictable.
-
Ivanti Connect Secure：修复 CVE-2026-104935 并调查此前可能发生的入侵
应将身份验证绕过漏洞的修复与入侵恢复分开处理：选择兼容的修复版本，保留取证证据，并结合网络和内存分析开展完整性检查。
-
LiteLLM 2026 年 10 月事件：已确认的 token 暴露与网关日志防护
LiteLLM 后续的复盘以 Agent Platform API 泄露 token 的证据，纠正了最初关于日志被盗的推测。该事件仍说明了为什么智能体凭据、响应体和特权自动化必须分别设置访问边界。
-
Postmortems ohne Schuldzuweisung: Ablauf, Ursachen und Massnahmen festhalten
Ein Postmortem beschreibt, was während eines Vorfalls geschah, wen es wie lange traf, welche Umstände es ermöglichten und welche Massnahmen eine Wiederholung unwahrscheinlicher machen. Schuldfreiheit ist kein Höflichkeitsgebot, sondern die Bedingung dafür, dass Beteiligte Fakten berichten statt sich zu verteidigen.
-
Correlation versus causation in incident and operations data
A correlation coefficient measures how two series move together; it says nothing about which one drives the other, whether a third factor such as traffic drives both, or whether the data were selected by the outcome. Plot first, condition on the obvious common causes, check timing, and confirm with an intervention such as a flag or canary before acting.
-
如何阅读服务商的数据泄露通知：核实发送方、范围与入侵指标
将服务商的数据泄露通知转化为经过核实的行动记录：确认真实性，明确受影响的资产和未查清的事实，并在下结论前使用留存日志评估入侵指标。
-
A first game day: one chaos experiment with a hypothesis, a blast radius and an abort rule
Run a first fault-injection exercise as a scheduled, announced experiment: define the steady state as a measurable output, hypothesise that it holds under one specific fault, limit the blast radius, set an abort condition, inject, and record what the system and the people did; the Principles of Chaos Engineering give the four steps and the Google SRE book describes disaster role-play as a weekly ritual.
-
PAN-OS CVE-2026-0322：核实各维护版本线的修复并恢复管理平面
PAN-OS 防火墙和 Panorama 的管理接口存在需通过身份验证才能利用的漏洞。应核对完整的维护版本号，限制管理访问，并在怀疑遭入侵时采用厂商针对硬件或虚拟设备的恢复流程。
-
Runbooks für den Betrieb: Anleitungen, die eine Fremde nachts ausführen kann
Ein Runbook pro Dienst beantwortet in dieser Reihenfolge: Was tut der Dienst, woran erkennt man in einer Minute, ob er gesund ist, welche bekannten Störungen gibt es mit Symptom, Diagnosebefehl und Gegenmassnahme, welche Handlungen sind sicher, welche gefährlich, und wer ist wann zu eskalieren; geprüft wird es von jemandem, der es nicht geschrieben hat.
-
Teams with fewer, alert-linked dashboards diagnose incidents faster than teams with many unowned dashboards
Hypothesis: for services of comparable size, the time from a page to a named probable cause is shorter when the team maintains a small number of owned dashboards that alerts link to directly, than when it maintains many copied or auto-generated dashboards that responders have to browse; a proposed comparison using incident timelines and dashboard inventories.
-
Running a public status page honestly: components, automation and history
A status page earns trust only when it turns red when users see red; host it off the infrastructure it reports on, list components users recognise, let everyone on call post without approval, update on a fixed cadence during incidents, and keep the history visible.
-
登录服务提供方遭入侵后：按范围重置、会话恢复与泄露密码筛查
恢复受影响的用户账号，同时不将每一次第三方泄露都视为本地已遭入侵的证据。将基于证据的重置和会话失效措施，与撞库监测及保护隐私的密码筛查相结合。
-
Bootstrapping NTP, DNS and DHCP after a full network outage: a dependency-ordered restart
Proposed methodology: after an outage that took down NTP, DNS and DHCP together, bring time up first, then DNS, then DHCP, because certificate and Kerberos checks need correct time, most services locate each other by name, and DHCP may depend on both, with the caveat that an NTP server using upstream hostnames itself needs DNS.
-
NetScaler ADC 与 Gateway：恢复前区分 9 月和 10 月的修复
CVE-2026-88771 和 CVE-2026-88772 的最低修复构建版本，与 SAML 拒绝服务漏洞 CVE-2026-88779 不同。应逐份匹配公告，调查是否遭到入侵，并审慎处理会话终止。
机器可读： JSON