Playbooks

🔑 Key Takeaway: Write playbooks for your most likely and most devastating scenarios before they hit. Each playbook should cover detection IOCs, containment, eradication, recovery, and a lessons-learned loop.

Incident response playbooks provide step-by-step procedures for handling specific security incidents. You cannot cover every scenario ahead of time, so prioritize the most likely and most devastating cases.

What this framework covers

1. Malware Infection: immediate containment when a host may be compromised.
2. North Korea (DPRK) Attack: victim guidance for confirmed DPRK compromise paths.
3. Wallet Drainer Attack: recover control after approval or signature drainage.
4. ELUSIVE COMET Attack: Zoom remote-control social engineering response.
5. SEAL 911 War Room Guidelines: how to engage SEAL 911 and run a crisis channel.
6. Decentralized Incident Response Framework (DeIRF): IR scaffold for teams without a single authority.

Best practices

1. Define the type of incident the playbook addresses (e.g., stolen funds, data breach, DDoS attack).
2. Outline the steps for detecting and analyzing the incident, including key indicators of compromise (IOCs) and tools to use.
3. Describe immediate actions to contain the incident and prevent further damage.
4. Provide detailed steps for eradicating the root cause of the incident.
5. Outline procedures for restoring everything affected to normal operation.
6. Detail the steps for conducting a lessons learned review.

For example incident runbooks and templates, see Incident Response Template: Templates.

Further reading

• Incident Management overview: how the pages of this framework fit together
• SEAL 911 War Room Guidelines: reaching outside help fast
• Incident Response Template overview: how the template pieces fit together
• Incident Detection and Response: the detection step before any playbook