building-incident-response-playbook

name	building-incident-response-playbook
description	Use when designs and documents structured incident response playbooks that define step-by-step procedures for specific incident types aligned with NIST SP 800-61r3 and SANS PICERL frameworks. Covers playbook structure, decision trees, escalation criteria, RACI matrices, and integration with SOAR platforms. Activates for requests involving IR playbook creation, incident response procedure documentation, response runbook development, or SOAR playbook design.
domain	cybersecurity
tags	["IR-playbook","runbook","NIST-800-61","SOAR-integration","response-procedures"]
subdomain	incident-response
mitre_attack	["T1190","T1566","T1078"]
version	1.0.0
author	oyi77
license	Apache-2.0
nist_csf	["RS.MA-01","RS.MA-02","RS.AN-03","RC.RP-01"]

Building Incident Response Playbook

Overview

Cybersecurity skill for building incident response playbook. Follows industry best practices and security standards.

When to Use

Trigger phrases:

• "building incident response playbook"

• "Designs and documents structured incident response playbooks that define step-by"

• Establishing or maturing an incident response program from scratch

• Documenting procedures for a new incident type after a novel attack

• Automating response workflows in a SOAR platform (Cortex XSOAR, Splunk SOAR)

• Preparing for compliance audits requiring documented IR procedures (SOC 2, PCI-DSS, HIPAA)

• Conducting a gap analysis of existing IR capabilities against specific threat scenarios

Do not use for one-time ad hoc investigations; playbooks are reusable procedure documents, not case-specific reports.

When NOT to Use

• When you lack proper authorization for testing
• For production systems without change management
• When the task requires legal or compliance expertise beyond technical scope

Prerequisites

• Organizational risk assessment identifying top incident scenarios by likelihood and impact
• NIST SP 800-61r3 or SANS PICERL framework adopted as the organizational IR standard
• Asset inventory with business criticality ratings and data classification
• RACI chart defining roles: Incident Commander, SOC analysts, system administrators, legal, communications
• Existing detection capabilities inventory (SIEM rules, EDR detections, IDS signatures)
• SOAR platform access if building automated playbooks

Workflow

# Example: IOC detection
import re

IOC_PATTERNS = {
    "ip": r"\b(?:\d{1,3}\.){3}\d{1,3}\b",
    "domain": r"\b[a-z0-9-]+\.[a-z]{2,}\b",
    "hash_md5": r"\b[a-f0-9]{32}\b",
    "hash_sha256": r"\b[a-f0-9]{64}\b",
}

def extract_iocs(text: ) -> :
     {k: re.findall(v, text)  k, v  IOC_PATTERNS.items()}