# Post-Incident Review Template
incident_review:
  incident_id: "INC-2024-001"
  incident_date: "2024-01-15"
  review_date: "2024-01-20"
  
  participants:
    - incident_commander
    - security_team
    - affected_service_owners
    - management_representative
  
  incident_summary:
    description: "Brief description of what happened"
    impact: "Business and technical impact"
    duration: "Time from detection to resolution"
    
  timeline:
    - time: "09:00"
      event: "Initial detection"
      source: "CloudWatch alarm"
    - time: "09:15"
      event: "Incident declared"
      action: "Incident response team activated"
      
  response_analysis:
    what_went_well:
      - "Rapid detection and alerting"
      - "Effective communication"
    
    what_could_improve:
      - "Delayed containment actions"
      - "Incomplete runbooks"
      
  root_causes:
    primary: "Misconfigured security group"
    contributing:
      - "Lack of configuration validation"
      - "Insufficient monitoring"
      
  lessons_learned:
    - lesson: "Need automated configuration validation"
      priority: "High"
      owner: "Security Team"
      due_date: "2024-02-15"

# Root Cause Analysis Tool
class RootCauseAnalysis:
    def __init__(self, incident_description):
        self.incident = incident_description
        self.causes = {{
            'technical': [],
            'process': [],
            'human': [],
            'organizational': []
        }}
    
    def five_whys_analysis(self, problem_statement):
        """
        Perform 5 Whys analysis to identify root cause
        """
        whys = []
        current_why = problem_statement
        
        for i in range(5):
            why = input(f"Why {i+1}: {current_why}? ")
            whys.append(why)
            current_why = why
            
        return whys
    
    def categorize_causes(self, causes):
        """
        Categorize identified causes into different types
        """
        for cause in causes:
            category = self.determine_category(cause)
            self.causes[category].append(cause)
    
    def generate_recommendations(self):
        """
        Generate improvement recommendations based on root causes
        """
        recommendations = []
        
        for category, causes in self.causes.items():
            for cause in causes:
                recommendation = self.create_recommendation(cause, category)
                recommendations.append(recommendation)
                
        return recommendations

# Example usage
incident = "Unauthorized access to production database"
rca = RootCauseAnalysis(incident)

# Perform analysis
root_causes = rca.five_whys_analysis("Database was accessed without authorization")
rca.categorize_causes(root_causes)
recommendations = rca.generate_recommendations()

{
  "lessons_learned_database": {
    "incident_id": "INC-2024-001",
    "date": "2024-01-15",
    "title": "Unauthorized Database Access",
    "severity": "High",
    "category": "Access Control",
    
    "summary": {
      "description": "Attacker gained unauthorized access to production database through compromised service account",
      "impact": "Potential data exposure affecting 10,000 customers",
      "duration": "4 hours from detection to containment"
    },
    
    "root_causes": [
      {
        "type": "technical",
        "description": "Service account had excessive privileges",
        "contributing_factors": [
          "Lack of least privilege implementation",
          "Insufficient access review process"
        ]
      },
      {
        "type": "process",
        "description": "Missing regular access certification",
        "contributing_factors": [
          "No automated access review",
          "Unclear ownership of service accounts"
        ]
      }
    ],
    
    "lessons_learned": [
      {
        "lesson": "Implement principle of least privilege for all service accounts",
        "category": "Access Management",
        "priority": "Critical",
        "implementation": {
          "owner": "Security Team",
          "due_date": "2024-02-15",
          "status": "In Progress",
          "progress": 60
        }
      },
      {
        "lesson": "Establish automated access review process",
        "category": "Process Improvement",
        "priority": "High",
        "implementation": {
          "owner": "Identity Team",
          "due_date": "2024-03-01",
          "status": "Planning",
          "progress": 20
        }
      }
    ],
    
    "preventive_measures": [
      {
        "measure": "Implement AWS IAM Access Analyzer",
        "description": "Continuously monitor and analyze access patterns",
        "status": "Completed"
      },
      {
        "measure": "Deploy AWS Config rules for privilege escalation",
        "description": "Detect and alert on privilege escalation attempts",
        "status": "In Progress"
      }
    ],
    
    "metrics": {
      "detection_time": "15 minutes",
      "response_time": "30 minutes",
      "containment_time": "2 hours",
      "recovery_time": "4 hours",
      "business_impact": "Medium"
    }
  }
}

# Continuous Improvement Tracking System
import boto3
import json
from datetime import datetime, timedelta

class ImprovementTracker:
    def __init__(self):
        self.dynamodb = boto3.resource('dynamodb')
        self.table = self.dynamodb.Table('incident-improvements')
        
    def add_improvement(self, incident_id, improvement_data):
        """
        Add a new improvement action from incident lessons learned
        """
        item = {
            'improvement_id': f"IMP-{datetime.now().strftime('%Y%m%d-%H%M%S')}",
            'incident_id': incident_id,
            'title': improvement_data['title'],
            'description': improvement_data['description'],
            'priority': improvement_data['priority'],
            'category': improvement_data['category'],
            'owner': improvement_data['owner'],
            'due_date': improvement_data['due_date'],
            'status': 'Open',
            'created_date': datetime.now().isoformat(),
            'progress': 0
        }
        
        self.table.put_item(Item=item)
        return item['improvement_id']
    
    def update_progress(self, improvement_id, progress, notes=None):
        """
        Update progress on an improvement action
        """
        update_expression = "SET progress = :progress, last_updated = :updated"
        expression_values = {
            ':progress': progress,
            ':updated': datetime.now().isoformat()
        }
        
        if notes:
            update_expression += ", notes = :notes"
            expression_values[':notes'] = notes
            
        if progress >= 100:
            update_expression += ", #status = :status, completion_date = :completed"
            expression_values[':status'] = 'Completed'
            expression_values[':completed'] = datetime.now().isoformat()
            
        self.table.update_item(
            Key={'improvement_id': improvement_id},
            UpdateExpression=update_expression,
            ExpressionAttributeValues=expression_values,
            ExpressionAttributeNames={'#status': 'status'} if progress >= 100 else None
        )
    
    def get_overdue_improvements(self):
        """
        Get list of overdue improvement actions
        """
        current_date = datetime.now().date()
        
        response = self.table.scan(
            FilterExpression="due_date < :current_date AND #status <> :completed",
            ExpressionAttributeValues=&#123;
                ':current_date': current_date.isoformat(),
                ':completed': 'Completed'
            &#125;,
            ExpressionAttributeNames=&#123;'#status': 'status'&#125;
        )
        
        return response['Items']
    
    def generate_improvement_report(self):
        """
        Generate report on improvement implementation status
        """
        response = self.table.scan()
        improvements = response['Items']
        
        report = &#123;
            'total_improvements': len(improvements),
            'completed': len([i for i in improvements if i['status'] == 'Completed']),
            'in_progress': len([i for i in improvements if i['status'] == 'In Progress']),
            'overdue': len(self.get_overdue_improvements()),
            'by_category': &#123;&#125;,
            'by_priority': &#123;&#125;
        &#125;
        
        # Group by category and priority
        for improvement in improvements:
            category = improvement.get('category', 'Unknown')
            priority = improvement.get('priority', 'Unknown')
            
            report['by_category'][category] = report['by_category'].get(category, 0) + 1
            report['by_priority'][priority] = report['by_priority'].get(priority, 0) + 1
            
        return report

# Example usage
tracker = ImprovementTracker()

# Add improvement from incident lessons learned
improvement_data = &#123;
    'title': 'Implement automated access review',
    'description': 'Deploy automated system to review and certify access permissions quarterly',
    'priority': 'High',
    'category': 'Access Management',
    'owner': 'security-team@company.com',
    'due_date': '2024-03-01'
&#125;

improvement_id = tracker.add_improvement('INC-2024-001', improvement_data)

# Update progress
tracker.update_progress(improvement_id, 25, "Initial planning completed")

# Generate report
report = tracker.generate_improvement_report()
print(json.dumps(report, indent=2))

# Incident Learning Metrics
learning_metrics:
  
  # Process Metrics
  process_effectiveness:
    - metric: "Post-incident review completion rate"
      target: "100%"
      description: "Percentage of incidents with completed post-incident reviews"
      
    - metric: "Average time to post-incident review"
      target: "< 5 business days"
      description: "Time from incident closure to completed review"
      
    - metric: "Lessons learned implementation rate"
      target: "> 90%"
      description: "Percentage of identified improvements that are implemented"
  
  # Quality Metrics
  learning_quality:
    - metric: "Root cause identification rate"
      target: "100%"
      description: "Percentage of incidents with identified root causes"
      
    - metric: "Repeat incident rate"
      target: "< 5%"
      description: "Percentage of incidents that are repeats of previous incidents"
      
    - metric: "Improvement effectiveness score"
      target: "> 8/10"
      description: "Stakeholder rating of improvement effectiveness"
  
  # Outcome Metrics
  security_improvement:
    - metric: "Mean time to detection (MTTD)"
      target: "Decreasing trend"
      description: "Average time from incident occurrence to detection"
      
    - metric: "Mean time to containment (MTTC)"
      target: "Decreasing trend"
      description: "Average time from detection to containment"
      
    - metric: "Incident severity distribution"
      target: "Shift toward lower severity"
      description: "Distribution of incidents by severity level"

# CloudWatch Insights Query for Incident Analysis
import boto3

def analyze_incident_logs(start_time, end_time, log_group):
    """
    Analyze CloudWatch logs for incident investigation
    """
    client = boto3.client('logs')
    
    query = """
    fields @timestamp, @message
    | filter @message like /ERROR/ or @message like /FAILED/
    | stats count() by bin(5m)
    | sort @timestamp desc
    """
    
    response = client.start_query(
        logGroupName=log_group,
        startTime=int(start_time.timestamp()),
        endTime=int(end_time.timestamp()),
        queryString=query
    )
    
    return response['queryId']

def get_cloudtrail_events(incident_timeframe):
    """
    Retrieve relevant CloudTrail events for incident analysis
    """
    client = boto3.client('cloudtrail')
    
    response = client.lookup_events(
        LookupAttributes=[
            {
                'AttributeKey': 'EventName',
                'AttributeValue': 'AssumeRole'
            }
        ],
        StartTime=incident_timeframe['start'],
        EndTime=incident_timeframe['end']
    )
    
    return response['Events']

# AWS Config Analysis for Incident Investigation
def analyze_config_changes(resource_id, incident_time):
    """
    Analyze configuration changes around incident time
    """
    config_client = boto3.client('config')
    
    # Get configuration history
    response = config_client.get_resource_config_history(
        resourceType='AWS::EC2::SecurityGroup',
        resourceId=resource_id,
        earlierTime=incident_time - timedelta(days=7),
        laterTime=incident_time + timedelta(hours=1)
    )
    
    changes = []
    for item in response['configurationItems']:
        changes.append({
            'timestamp': item['configurationItemCaptureTime'],
            'status': item['configurationItemStatus'],
            'configuration': item['configuration']
        })
    
    return changes

def check_compliance_violations(resource_type, incident_time):
    """
    Check for compliance violations around incident time
    """
    response = config_client.get_compliance_details_by_resource(
        ResourceType=resource_type,
        ResourceId=resource_id
    )
    
    violations = []
    for result in response['EvaluationResults']:
        if result['ComplianceType'] == 'NON_COMPLIANT':
            violations.append({
                'rule': result['EvaluationResultIdentifier']['EvaluationResultQualifier']['ConfigRuleName'],
                'timestamp': result['ResultRecordedTime'],
                'annotation': result.get('Annotation', '')
            })
    
    return violations

# Amazon Detective Integration
def create_detective_investigation(incident_data):
    """
    Create investigation in Amazon Detective
    """
    detective_client = boto3.client('detective')
    
    # Create investigation
    response = detective_client.start_investigation(
        GraphArn=incident_data['graph_arn'],
        EntityArn=incident_data['entity_arn'],
        ScopeStartTime=incident_data['start_time'],
        ScopeEndTime=incident_data['end_time']
    )
    
    return response['InvestigationId']

def get_detective_findings(investigation_id):
    """
    Retrieve findings from Detective investigation
    """
    response = detective_client.get_investigation(
        GraphArn=graph_arn,
        InvestigationId=investigation_id
    )
    
    return response['Investigation']

# Automated Post-Incident Review System
import boto3
import json
from datetime import datetime, timedelta

class PostIncidentReviewAutomation:
    def __init__(self):
        self.stepfunctions = boto3.client('stepfunctions')
        self.sns = boto3.client('sns')
        self.dynamodb = boto3.resource('dynamodb')
        
    def trigger_review_workflow(self, incident_id):
        """
        Trigger automated post-incident review workflow
        """
        workflow_input = {
            'incident_id': incident_id,
            'review_scheduled': (datetime.now() + timedelta(days=2)).isoformat(),
            'participants': self.get_incident_participants(incident_id)
        }
        
        response = self.stepfunctions.start_execution(
            stateMachineArn='arn:aws:states:region:account:stateMachine:PostIncidentReview',
            input=json.dumps(workflow_input)
        )
        
        return response['executionArn']
    
    def collect_feedback(self, incident_id, participant_email):
        """
        Collect feedback from incident participants
        """
        # Send feedback form via email
        feedback_url = f"https://feedback.company.com/incident/{incident_id}?participant={participant_email}"
        
        message = f"""
        Post-Incident Review: {incident_id}
        
        Please provide your feedback on the incident response:
        {feedback_url}
        
        Deadline: {(datetime.now() + timedelta(days=3)).strftime('%Y-%m-%d')}
        """
        
        self.sns.publish(
            TopicArn='arn:aws:sns:region:account:incident-feedback',
            Message=message,
            Subject=f'Post-Incident Review Required: {incident_id}'
        )
    
    def generate_review_report(self, incident_id):
        """
        Generate comprehensive post-incident review report
        """
        # Collect all feedback and data
        incident_data = self.get_incident_data(incident_id)
        feedback_data = self.get_feedback_data(incident_id)
        timeline_data = self.get_timeline_data(incident_id)
        
        report = {
            'incident_id': incident_id,
            'review_date': datetime.now().isoformat(),
            'incident_summary': incident_data,
            'timeline': timeline_data,
            'feedback_summary': self.analyze_feedback(feedback_data),
            'lessons_learned': self.extract_lessons_learned(feedback_data),
            'improvement_actions': self.generate_improvement_actions(feedback_data)
        }
        
        # Store report
        self.store_review_report(report)
        
        return report

# Incident Trend Analysis System
class IncidentTrendAnalysis:
    def __init__(self):
        self.dynamodb = boto3.resource('dynamodb')
        self.incidents_table = self.dynamodb.Table('security-incidents')
        
    def analyze_incident_trends(self, time_period_days=90):
        """
        Analyze trends in security incidents
        """
        end_date = datetime.now()
        start_date = end_date - timedelta(days=time_period_days)
        
        # Query incidents in time period
        response = self.incidents_table.scan(
            FilterExpression="incident_date BETWEEN :start_date AND :end_date",
            ExpressionAttributeValues={
                ':start_date': start_date.isoformat(),
                ':end_date': end_date.isoformat()
            }
        )
        
        incidents = response['Items']
        
        # Analyze trends
        trends = {
            'total_incidents': len(incidents),
            'by_severity': self.group_by_severity(incidents),
            'by_category': self.group_by_category(incidents),
            'by_root_cause': self.group_by_root_cause(incidents),
            'repeat_incidents': self.identify_repeat_incidents(incidents),
            'improvement_effectiveness': self.measure_improvement_effectiveness(incidents)
        }
        
        return trends
    
    def identify_repeat_incidents(self, incidents):
        """
        Identify incidents that are repeats of previous incidents
        """
        repeat_patterns = {}
        
        for incident in incidents:
            signature = self.create_incident_signature(incident)
            
            if signature in repeat_patterns:
                repeat_patterns[signature]['count'] += 1
                repeat_patterns[signature]['incidents'].append(incident['incident_id'])
            else:
                repeat_patterns[signature] = {
                    'count': 1,
                    'incidents': [incident['incident_id']],
                    'pattern': signature
                }
        
        # Return only patterns with multiple incidents
        return {k: v for k, v in repeat_patterns.items() if v['count'] > 1}
    
    def create_incident_signature(self, incident):
        """
        Create a signature for incident pattern matching
        """
        return f"{incident.get('category', 'unknown')}-{incident.get('attack_vector', 'unknown')}-{incident.get('affected_service', 'unknown')}"
    
    def generate_trend_report(self):
        """
        Generate comprehensive trend analysis report
        """
        trends = self.analyze_incident_trends()
        
        report = {
            'report_date': datetime.now().isoformat(),
            'analysis_period': '90 days',
            'key_findings': self.extract_key_findings(trends),
            'recommendations': self.generate_recommendations(trends),
            'metrics': trends
        }
        
        return report

# Standard Post-Incident Review Template
post_incident_review:
  metadata:
    incident_id: "Required"
    review_date: "Required"
    facilitator: "Required"
    participants: "Required list"
    
  incident_overview:
    description: "What happened?"
    impact: "What was the business/technical impact?"
    timeline: "Key events and timeline"
    
  analysis:
    what_went_well: "What aspects of the response were effective?"
    what_could_improve: "What could have been done better?"
    root_causes: "What were the underlying causes?"
    
  lessons_learned:
    - lesson: "Specific lesson learned"
      category: "Technical/Process/Human/Organizational"
      priority: "Critical/High/Medium/Low"
      
  action_items:
    - action: "Specific improvement action"
      owner: "Responsible person/team"
      due_date: "Target completion date"
      success_criteria: "How will we know it's done?"

# Systematic Root Cause Analysis Framework
class RootCauseAnalysisFramework:
    def __init__(self):
        self.analysis_methods = [
            'five_whys',
            'fishbone_diagram',
            'fault_tree_analysis',
            'timeline_analysis'
        ]
    
    def conduct_analysis(self, incident_data, method='five_whys'):
        """
        Conduct root cause analysis using specified method
        """
        if method == 'five_whys':
            return self.five_whys_analysis(incident_data)
        elif method == 'fishbone_diagram':
            return self.fishbone_analysis(incident_data)
        elif method == 'fault_tree_analysis':
            return self.fault_tree_analysis(incident_data)
        elif method == 'timeline_analysis':
            return self.timeline_analysis(incident_data)
    
    def five_whys_analysis(self, incident_data):
        """
        Perform 5 Whys analysis
        """
        problem = incident_data['problem_statement']
        whys = []
        
        current_question = f"Why did {problem} occur?"
        
        for i in range(5):
            # In practice, this would involve stakeholder input
            answer = self.get_stakeholder_input(current_question)
            whys.append({
                'question': current_question,
                'answer': answer,
                'level': i + 1
            })
            current_question = f"Why {answer}?"
        
        return {
            'method': 'five_whys',
            'analysis': whys,
            'root_cause': whys[-1]['answer'] if whys else None
        }
    
    def fishbone_analysis(self, incident_data):
        """
        Perform fishbone (Ishikawa) diagram analysis
        """
        categories = [
            'People', 'Process', 'Technology', 
            'Environment', 'Materials', 'Methods'
        ]
        
        analysis = {
            'method': 'fishbone_diagram',
            'problem': incident_data['problem_statement'],
            'categories': {}
        }
        
        for category in categories:
            causes = self.identify_causes_by_category(incident_data, category)
            analysis['categories'][category] = causes
        
        return analysis

# Improvement Action Tracking System
class ImprovementActionTracker:
    def __init__(self):
        self.dynamodb = boto3.resource('dynamodb')
        self.actions_table = self.dynamodb.Table('improvement-actions')
        self.sns = boto3.client('sns')
    
    def create_action(self, action_data):
        """
        Create new improvement action from lessons learned
        """
        action_id = f"ACT-{datetime.now().strftime('%Y%m%d-%H%M%S')}"
        
        item = {
            'action_id': action_id,
            'incident_id': action_data['incident_id'],
            'title': action_data['title'],
            'description': action_data['description'],
            'owner': action_data['owner'],
            'priority': action_data['priority'],
            'due_date': action_data['due_date'],
            'status': 'Open',
            'created_date': datetime.now().isoformat(),
            'progress': 0
        }
        
        self.actions_table.put_item(Item=item)
        
        # Notify owner
        self.notify_action_owner(action_id, action_data['owner'])
        
        return action_id
    
    def update_progress(self, action_id, progress, notes=None):
        """
        Update progress on improvement action
        """
        update_expression = "SET progress = :progress, last_updated = :updated"
        expression_values = {
            ':progress': progress,
            ':updated': datetime.now().isoformat()
        }
        
        if notes:
            update_expression += ", progress_notes = :notes"
            expression_values[':notes'] = notes
        
        if progress >= 100:
            update_expression += ", #status = :status, completed_date = :completed"
            expression_values[':status'] = 'Completed'
            expression_values[':completed'] = datetime.now().isoformat()
        
        self.actions_table.update_item(
            Key={'action_id': action_id},
            UpdateExpression=update_expression,
            ExpressionAttributeValues=expression_values,
            ExpressionAttributeNames={'#status': 'status'} if progress >= 100 else None
        )
    
    def check_overdue_actions(self):
        """
        Check for overdue improvement actions and send notifications
        """
        current_date = datetime.now().date()
        
        response = self.actions_table.scan(
            FilterExpression="due_date < :current_date AND #status <> :completed",
            ExpressionAttributeValues=&#123;
                ':current_date': current_date.isoformat(),
                ':completed': 'Completed'
            &#125;,
            ExpressionAttributeNames=&#123;'#status': 'status'&#125;
        )
        
        overdue_actions = response['Items']
        
        for action in overdue_actions:
            self.notify_overdue_action(action)
        
        return overdue_actions

# Learning Effectiveness Measurement
class LearningEffectivenessMeasurement:
    def __init__(self):
        self.dynamodb = boto3.resource('dynamodb')
        self.incidents_table = self.dynamodb.Table('security-incidents')
        self.improvements_table = self.dynamodb.Table('improvement-actions')
    
    def calculate_learning_metrics(self, time_period_days=90):
        """
        Calculate key learning effectiveness metrics
        """
        end_date = datetime.now()
        start_date = end_date - timedelta(days=time_period_days)
        
        metrics = {
            'post_incident_review_completion_rate': self.calculate_review_completion_rate(start_date, end_date),
            'improvement_implementation_rate': self.calculate_improvement_implementation_rate(start_date, end_date),
            'repeat_incident_rate': self.calculate_repeat_incident_rate(start_date, end_date),
            'mean_time_to_lessons_learned': self.calculate_mean_time_to_lessons_learned(start_date, end_date),
            'learning_impact_score': self.calculate_learning_impact_score(start_date, end_date)
        }
        
        return metrics
    
    def calculate_review_completion_rate(self, start_date, end_date):
        """
        Calculate percentage of incidents with completed post-incident reviews
        """
        # Get all incidents in period
        incidents_response = self.incidents_table.scan(
            FilterExpression="incident_date BETWEEN :start_date AND :end_date",
            ExpressionAttributeValues={
                ':start_date': start_date.isoformat(),
                ':end_date': end_date.isoformat()
            }
        )
        
        total_incidents = len(incidents_response['Items'])
        
        # Count incidents with completed reviews
        completed_reviews = len([
            incident for incident in incidents_response['Items']
            if incident.get('post_incident_review_completed', False)
        ])
        
        return (completed_reviews / total_incidents * 100) if total_incidents > 0 else 0
    
    def calculate_repeat_incident_rate(self, start_date, end_date):
        """
        Calculate percentage of incidents that are repeats
        """
        incidents_response = self.incidents_table.scan(
            FilterExpression="incident_date BETWEEN :start_date AND :end_date",
            ExpressionAttributeValues={
                ':start_date': start_date.isoformat(),
                ':end_date': end_date.isoformat()
            }
        )
        
        incidents = incidents_response['Items']
        total_incidents = len(incidents)
        
        # Identify repeat incidents
        repeat_count = 0
        incident_signatures = {}
        
        for incident in incidents:
            signature = self.create_incident_signature(incident)
            if signature in incident_signatures:
                repeat_count += 1
            else:
                incident_signatures[signature] = incident['incident_id']
        
        return (repeat_count / total_incidents * 100) if total_incidents > 0 else 0
    
    def generate_learning_dashboard(self):
        """
        Generate dashboard data for learning effectiveness
        """
        metrics = self.calculate_learning_metrics()
        
        dashboard_data = {
            'summary': {
                'total_incidents_90_days': self.get_incident_count(90),
                'reviews_completed': f"{metrics['post_incident_review_completion_rate']:.1f}%",
                'improvements_implemented': f"{metrics['improvement_implementation_rate']:.1f}%",
                'repeat_incident_rate': f"{metrics['repeat_incident_rate']:.1f}%"
            },
            'trends': self.get_learning_trends(),
            'top_lessons_learned': self.get_top_lessons_learned(),
            'improvement_status': self.get_improvement_status_summary()
        }
        
        return dashboard_data