Playbooks

Authored by:

Dickson Wu

SEAL

These playbooks are reference material: they help teams think through common incident types, decision points, and response patterns. They are not drop-in internal operating procedures.

For copy-and-adapt operational documentation, see Incident Response Template: Templates and Incident Response Template: Runbooks.

Best Practices

1. Define the type of incident the playbook addresses (e.g., stolen funds, data breach, DDoS attack).
2. Outline the steps for detecting and analyzing the incident, including key indicators of compromise (IOCs) and tools to use.
3. Describe immediate actions to contain the incident and prevent further damage.
4. Provide detailed steps for eradicating the root cause of the incident.
5. Outline procedures for restoring everything affected to normal operation.
6. Detail the steps for conducting a lessons learned review.

For example incident runbooks and templates, see Incident Response Template: Templates.