GUIDES · OPERATE
Running an incident retro on threatDefendr.
A good retro is built on facts, not memory. Because every event, detection, and action is on the fabric, you reconstruct exactly what happened, measure where the response was slow, and close the loop by shipping the gaps back as detections.
Reconstruct the timeline
Start from the case. Its timeline already holds every event, detection, and action in order — export it as the spine of the retro instead of rebuilding it from chat logs.
SHELLexport the timeline $ td case timeline case_7Qd2 --export md > retro/timeline.md -> 11 events . 2 detections . 3 actions -> first signal 14:21:08Z . contained 14:31:55Z ok wrote retro/timeline.md
Measure the response
Three numbers turn a story into a scorecard. The fabric timestamps each phase, so they are read off the record, not estimated.
| Metric | From → to |
|---|---|
| MTTD — detect | First malicious event → first detection firing. |
| MTTC — contain | First detection → first containment action applied. |
| MTTR — resolve | First detection → case closed. |
Ship the learnings
The retro is only done when the gap it found cannot recur silently. Turn “we missed the lateral move” into a detection and commit it the same week.
Close the loop in code. Every “we should have caught X” is a detection waiting to be written. Author it, back-test it against this very incident to prove it would have fired, and ship it — see detection-as-code.
Where to go next
- War room from a case — where the timeline is captured.
- Detection-as-code — ship the fix.