What is a playbook?
For any cyber threat or attack, the SOC team works sequentially through three high-level processes: Detection, Analysis, Remediation. Each contains sub-processes that require step-by-step actions performed using various tools. All the individual stepped processes are playbooks, mapping to each other to create a chained connection that solves a bigger end-to-end attack workflow.
Detection
The detection phase contains a set of sub-processes with structured steps to monitor the network, SIEM, capture indicators.
Analysis
The analysis phase similarly has sub-processes, for example WHOIS IP lookup, malware analysis using a sandbox, gathering indicators.
Remediation
The remediation phase contains multiple sub-processes for cleaning the assets, blocking a bad IP, banning a malware hash in the endpoint tool.
The need for open source playbooks
It is very difficult for any one organisation to prepare such a guide alone. With open source playbooks we achieve standardisation, automation, wide acceptance, validation, continuous improvement, and improved response time.
Approach
- Playbook Designer. A workflow designer to build process steps graphically.
- Data representation. Convert designed playbooks into JSON/XML that the backend engine can execute.
- Automation Engine. Read the playbook and execute it.
Originally published 26 March 2018. Migrated to the new IRC site in 2026.