Resources

IR playbooks

Procedures for an incident already in progress. Four categories. Every playbook on this site is public.

All playbooks

Playbook	Category	Level	Time
Phishing Response Basics	Threat-Specific	beginner	30-60 min
Malware Triage Fundamentals	Threat-Specific	beginner	1-2 hours
First Responder Checklist	Initial Response	beginner	15-30 min
Account Compromise Quick Reference	Initial Response	beginner	30-60 min
Incident Classification Matrix	Initial Response	beginner	10-15 min
Ransomware Response Playbook	Threat-Specific	advanced	Multiple days
Business Email Compromise (BEC) Response	Threat-Specific	advanced	2-4 hours initial, ongoing
Insider Threat Investigation	Threat-Specific	advanced	Days to weeks
Data Exfiltration Investigation	Threat-Specific	advanced	Days to weeks
Cryptominer Detection and Response	Threat-Specific	intermediate	1-3 hours
Memory Forensics Basics	Technical Procedures	intermediate	2-4 hours
Network Traffic Analysis for Incident Response	Technical Procedures	intermediate	2-4 hours
Log Analysis Workflow	Technical Procedures	intermediate	1-4 hours
IOC Collection Guide	Technical Procedures	beginner	Ongoing
Endpoint Forensics Collection	Technical Procedures	intermediate	2-4 hours per system
Executive Briefing Template	Communication	intermediate	30-60 min preparation
Legal Notification Checklist	Communication	intermediate	Ongoing
Customer Communication Scripts	Communication	intermediate	1-2 hours preparation
Escalation Matrix and Procedures	Communication	beginner	Template - customize for organization