The IRC library carries everything published since 2017 plus the new member-authored Practitioner Runbooks, live now.
Everything below is active and accessible from any membership tier, including Open. Direct links open the existing IRC content unchanged for the relaunch.
Open source IR playbooks, runbooks, and response plans. Detection, Analysis, and Remediation flows for the most common attack patterns. Used by IR teams and SOCs around the world since 2017.
Open the engine →Curated list of the IR books, NIST and ISO frameworks, and CISA references that members keep coming back to. Updated annually by the Editorial Committee.
Browse the list →Vetted tooling and reference material. Threat intel feeds, sandboxes, forensics tooling, and the IR utilities practitioners actually use. Member-suggested.
Open the index →Current openings in incident response, SOC operations, threat intel, and forensics. Submitted by hiring teams, vetted before listing.
See open roles →Ninety one security policies, plans, forms and reference documents, grouped by topic with search and filters. Preview any document in the browser and download it in its original format or as PDF.
Browse the library →Allocate a security operations budget across people, process and tooling, then find out whether your choices survive a breach. An IRC original since 2015, rebuilt for the relaunch and playable in the browser.
Play the game →Member-authored, attributed, plain English. Short, focused guides written by named practitioners for the person who has to do the thing tomorrow. The first 5 are live, with more publishing as the community contributes.
How to run a reported-phishing queue that catches the one email that matters without drowning the team in the ninety-nine that do not. Verdicts, time boxes and when to escalate to incident.
By Dominic AslanHow to run a post-incident review that produces fixes instead of a filing-cabinet report: timing, the meeting itself, blame handling, and the follow-through that separates learning from paperwork.
By Dominic AslanHow to plan and chair a first incident response tabletop that people take seriously: scope, scenario, injects, the ninety-minute agenda, and turning what surfaced into fixes that actually land.
By Dominic AslanA working sequence for the first day of a ransomware incident, from the first confirmed encryption to the end of day one. What to do, in what order, and the mistakes that make day two worse.
By Dominic AslanWritten by a practitioner, published under your name. Submissions to hello@incidentresponse.com.
Top 10 breaches, IR plan guidance, SME readiness, technology and defence pieces. New posts as the community publishes.
Open the blog ConferenceEleven sessions from the 2019 IRC conference, with slides preserved. Still relevant where the topics still are.
Open the IR19 archiveCommunity calls coming up, new resources published, and what we're seeing across the membership.
One email a month. Unsubscribe any time. Read our privacy notice.