Incident Response → Documentation → Lessons Learned

Provide Claude with your incident response logs, chat transcripts, and action records. Ask it to construct a clear timeline of events, identify the root cause, document containment and eradication steps taken, and highlight any deviations from standard procedures.

Prompt Claude to analyze the incident response for lessons learned, process gaps, tool limitations, and training needs. Request specific recommendations for updating runbooks, improving detection capabilities, and strengthening preventive controls based on this incident.

Use Claude's analysis to populate a standardized incident report template in Confluence. Include executive summary, technical details, timeline, impact assessment, and action items. Link to existing security procedures and create update tickets for any process improvements identified.

Create Jira tickets for each improvement opportunity and remediation action identified by Claude. Set appropriate priorities, assign owners, and link back to the Confluence incident report. Use labels to categorize improvements by type (process, technology, training).