triaging-security-incident-with-ir-playbook

name	triaging-security-incident-with-ir-playbook
description	Classify and prioritize security incidents using structured IR playbooks to determine severity, assign response teams, and initiate appropriate response procedures. Use when working with triaging security incident with ir playbook.
domain	cybersecurity
tags	["incident-response","triage","playbook","severity-classification","soc"]
subdomain	incident-response
mitre_attack	["T1190","T1566","T1078"]
version	1.0
author	oyi77
license	Apache-2.0
nist_csf	["RS.MA-01","RS.MA-02","RS.AN-03","RC.RP-01"]

Triaging Security Incident With Ir Playbook

Overview

Cybersecurity skill for triaging security incident with ir playbook. Follows industry best practices and security standards.

When to Use

Trigger phrases:

• "triaging security incident with ir playbook"

• "Classify and prioritize security incidents using structured IR playbooks to dete"

• New security alert received from SIEM, EDR, or other detection sources

• SOC analyst needs to determine if an alert is a true positive requiring response

• Incident needs severity classification and team assignment

• Multiple concurrent incidents require prioritization

• Automated triage rules need validation or tuning

When NOT to Use

• When you lack proper authorization for testing
• For production systems without change management
• When the task requires legal or compliance expertise beyond technical scope

Prerequisites

• SIEM platform with alert correlation (Splunk, Elastic, QRadar, Sentinel)
• Incident response playbook library (by incident type)
• Severity classification matrix approved by CISO
• On-call rotation and escalation procedures
• Ticketing system for incident tracking (ServiceNow, Jira, TheHive)
• Threat intelligence feeds for IOC enrichment

Workflow

# Example: IOC detection
import re

IOC_PATTERNS = {
    "ip": r"\b(?:\d{1,3}\.){3}\d{1,3}\b",
    "domain": r"\b[a-z0-9-]+\.[a-z]{2,}\b",
    "hash_md5": r"\b[a-f0-9]{32}\b",
    "hash_sha256": r"\b[a-f0-9]{64}\b",
}

def extract_iocs(text: str) -> dict:
    return {k: re.findall(v, text) for k, v in IOC_PATTERNS.items()}

1. — Clarify the goals and scope for security incident.