| name | building-incident-response-playbook |
| description | Designs and documents structured incident response playbooks with step-by-step procedures per incident type, decision trees, escalation criteria, RACI matrices, and SOAR platform integration, aligned to NIST SP 800-61r3 and SANS PICERL. Use when creating or maturing an IR program, documenting response runbooks for a new incident type, or designing SOAR playbooks. |
| domain | cybersecurity |
| subdomain | incident-response |
| tags | ["IR-playbook","runbook","NIST-800-61","SOAR-integration","response-procedures"] |
| mitre_attack | ["T1486","T1566","T1190","T1041","T1078"] |
| version | 1.0.0 |
| author | mahipal |
| license | Apache-2.0 |
| nist_csf | ["RS.MA-01","RS.MA-02","RS.AN-03","RC.RP-01"] |
Building Incident Response Playbooks
When to Use
- Establishing or maturing an incident response program from scratch
- Documenting procedures for a new incident type after a novel attack
- Automating response workflows in a SOAR platform (Cortex XSOAR, Splunk SOAR)
- Preparing for compliance audits requiring documented IR procedures (SOC 2, PCI-DSS, HIPAA)
- Conducting a gap analysis of existing IR capabilities against specific threat scenarios
Do not use for one-time ad hoc investigations; playbooks are reusable procedure documents, not case-specific reports.
Prerequisites
- Organizational risk assessment identifying top incident scenarios by likelihood and impact
- NIST SP 800-61r3 or SANS PICERL framework adopted as the organizational IR standard
- Asset inventory with business criticality ratings and data classification
- RACI chart defining roles: Incident Commander, SOC analysts, system administrators, legal, communications
- Existing detection capabilities inventory (SIEM rules, EDR detections, IDS signatures)
- SOAR platform access if building automated playbooks
Workflow
Step 1: Select and Scope the Incident Type
Define the specific scenario the playbook will address:
- Identify the top incident types based on organizational risk assessment and historical data
- Scope each playbook to a single incident type for clarity (do not combine unrelated scenarios)
- Define trigger conditions that activate the playbook
Common playbook types:
Priority Playbooks (build first):
1. Ransomware incident response
2. Phishing/credential compromise
3. Business email compromise
4. Malware infection
5. Data breach/exfiltration
6. DDoS attack
7. Insider threat
8. Account takeover
9. Web application compromise
10. Cloud infrastructure compromise
Step 2: Define the Playbook Structure
Every playbook should follow a consistent structure:
PLAYBOOK TEMPLATE
━━━━━━━━━━━━━━━━
1. Playbook Metadata
- Name, version, owner, last review date
- Trigger conditions
- Severity criteria
2. RACI Matrix
- Who is Responsible, Accountable, Consulted, Informed for each step
3. Detection & Triage
- How the incident is detected
- Initial triage checklist
- Severity classification criteria
4. Containment
- Short-term containment actions
- Long-term containment actions
- Evidence preservation requirements
5. Eradication
- Root cause identification
- Malware/threat removal steps
- Verification procedures
6. Recovery
- System restoration steps
- Validation criteria
- Monitoring requirements post-recovery
7. Post-Incident
- Lessons learned meeting trigger
- Report template
- Detection improvement actions
8. Communication
- Internal notification matrix
- External notification requirements (regulators, customers, law enforcement)
- Status update cadence
9. Appendices
- Tool-specific procedures
- Contact lists
- Evidence collection checklists
