SOC Incident Response
Playbooks
Battle-tested incident response playbooks for modern security teams. Covering 9 attack categories with step-by-step procedures, automation hints, and MITRE ATT&CK mappings.
★ GitHub15 playbooks across 9 categories
🔍
Category
Severity
Showing 15 of 15 playbooks
📧
mediumhigh
Phishing Email Investigation
IR-001email-security
⏱ 30m📋 12 steps🔧 5 tools
T1566.001T1566.002T1598.003+2
phishingemailcredential-theftbec
View Playbook →
💻
highcritical
Malware Endpoint Containment
IR-002endpoint
⏱ 45m📋 12 steps🔧 5 tools
T1059.001T1059.003T1055+5
malwareendpointcontainmentedr
View Playbook →
🪪
mediumhigh
Brute Force Authentication Attack
IR-003identity
⏱ 20m📋 9 steps🔧 4 tools
T1110.001T1110.003T1110.004+2
brute-forcecredential-attackpassword-sprayaccount-lockout
View Playbook →
☁️
highcritical
AWS Unauthorized Access via CloudTrail Anomaly
IR-004cloud
⏱ 40m📋 10 steps🔧 5 tools
T1078.004T1530T1552.005+4
awscloudiamcloudtrail
View Playbook →
💾
highcritical
Data Exfiltration via DLP Alert
IR-005data-loss
⏱ 60m📋 10 steps🔧 5 tools
T1048T1048.003T1041+4
data-lossexfiltrationdlppii
View Playbook →
🔒
critical
Ransomware Initial Response and Containment
IR-006ransomware
⏱ 15m📋 10 steps🔧 5 tools
T1486T1490T1489+6
ransomwarecritical-incidentcontainmentencryption
View Playbook →
📋
mediumhigh
Insider Threat Investigation
IR-007insider-threat
⏱ 90m📋 10 steps🔧 5 tools
T1078T1213T1052.001+4
insider-threatuebadata-theftemployee-monitoring
View Playbook →
☁️
highcritical
Cloud Resource Hijacking (Cryptomining and Unauthorized Compute)
IR-008cloud
⏱ 35m📋 9 steps🔧 5 tools
T1496T1578.002T1578.003+4
cloudcryptominingresource-hijackingaws
View Playbook →
🔗
critical
Software Supply Chain Compromise
IR-009supply-chain
⏱ 120m📋 11 steps🔧 5 tools
T1195.001T1195.002T1554+5
supply-chaindependency-compromiseopen-sourcenpm
View Playbook →
💻
highcritical
Privilege Escalation Detection and Response
IR-010endpoint
⏱ 30m📋 10 steps🔧 5 tools
T1068T1548.002T1548.003+6
privilege-escalationuac-bypasstoken-manipulationadmin-rights
View Playbook →
☁️
mediumhighcritical
AI/ML Model Abuse and Training Data Poisoning
IR-011cloud
⏱ 60m📋 10 steps🔧 6 tools
T1190T1078T1496+4
aimlllmprompt-injection
View Playbook →
📋
mediumhighcritical
API Abuse and Credential Stuffing Attack Response
IR-012network
⏱ 45m📋 10 steps🔧 6 tools
T1110.004T1110.003T1078+4
apicredential-stuffingrate-limitingapi-gateway
View Playbook →
🪪
highcritical
SaaS Account Compromise (M365, Google Workspace, Slack)
IR-013identity
⏱ 50m📋 10 steps🔧 6 tools
T1078.004T1556.006T1114.002+5
saasmicrosoft-365google-workspaceslack
View Playbook →
☁️
highcritical
Container and Kubernetes Security Incident Response
IR-014cloud
⏱ 60m📋 10 steps🔧 7 tools
T1610T1613T1611+5
kubernetescontainerk8scontainer-escape
View Playbook →
🪪
highcritical
Non-Human Identity (NHI) Compromise — Service Accounts, API Keys, and CI/CD Tokens
IR-015identity
⏱ 55m📋 10 steps🔧 7 tools
T1078.004T1552.001T1552.004+5
nhiservice-accountapi-keyoauth-token
View Playbook →