IR playbooks

Initial Response

First responder procedures for when an incident is detected

First Responder ChecklistQuick-reference checklist for the critical first minutes of any security incident, focusing on preservation and escalation.beginner · 15-30 min
Account Compromise Quick ReferenceEssential steps to contain and investigate a compromised user account, with focus on speed and preservation.beginner · 30-60 min
Incident Classification MatrixDecision tree and matrix to help responders classify incidents and determine appropriate escalation paths.beginner · 10-15 min