Incident response documentation

[swethaa-11]

No description provided.

[github-actions]

🔒 OWASP Scanner Results

No vulnerabilities detected.

### File: incident response documentation.md

🔒 OWASP Scanner Results for incident response documentation.md

✅ No vulnerabilities found.

✅ Good to go.

[VishalAbiman05]

I've read through the Incident Response document. Overall it's very solid—good structure, practical playbooks, and I like that it's based on real alerts we've seen.

A few notes from a security review perspective:

• No hardcoded secrets or internal IPs found, so that's fine.
• The playbooks are actionable and fit our environment well.

A couple of small suggestions:

1. Add an internal classification label at the top (e.g., "Internal – Redback Team Only"). Just a reminder not to share externally.
2. In Playbook 1, the iptables command works but might be worth noting it's temporary (won't survive a reboot unless saved).
3. The log examples look fine, but double-check they're fully anonymised.

No major issues from me. Good to merge after those tweaks.