We have just upgraded our new SOC brick and block kit.
The idea behind the kit is to provide a fun way to look at the cyber security industry. The desk-size SOC system shows two workers analysing different alerts. Many of the industry's practitioners grew up with bricks and blocks trying to build the coolest things they could imagine. This kit gives a playful way to think about the next generation of security integration and interoperability.
Why playbooks matter
Cyber security practitioners follow a sequence of steps to solve and remediate incidents. A playbook engine offers consistency and repeatability for day-to-day operations. As alert volumes climb, analysts can overlook key indicators that are critical to the organisation's security.
Experienced analysts might be tempted to make out-of-process calls and skip key parts of the IR plan based on incomplete information or impatience. With playbooks, the same data is assembled for every alert, and every notification is investigated and recorded in the same approved manner each time. The result matches the desired outcome with no curveballs.
Editor's note, May 2026: This was a CyberSponse company post from 2017 carried on the IRC site. Preserved here for the archive.
Originally published 16 March 2017. Migrated to the new IRC site in 2026.