Skip to main content

Playbooks

A playbook is a guide to help people in charge of handling security incidents.

It includes the full steps to be taken to attend an incident from the Preparation to Post-incident activities, currently this is the methodology that we uses:

Within this document is possible to visualize the list of current playbooks and runbooks that has developed.

It is important to emphasize the Playbooks will invoke the Runbooks depending of the type of incident, as well as the phase of our methodology.

A runbook is a technical guide that contains the specific procedures to be done in different activities.

List of Playbooks
#

Below is possible to visualize the current list of available Playbooks and their status:

#Playbook Name
1Ransomware
2Data Breach
3Phishing Attack
4Distributed Denial of Service (DDoS)
5Malware Infection/Attack
6Credential Compromise
7Advanced Persistent Threat and targeted attack
8Web Application Attack
9Cloud Security Incident
10Business Email Compromise (BEC)

List of Runbooks
#

Below is possible to visualize the current list of available Runbooks and their status:

#Playbook Name
1Disk Acquisition - Dead System
2Disk Acquisition - Live System
3Disk Analysis
4Endpoint Detection And Response
5Event Log Analysis
6Event Log Parsing
7Installing And Updating Tools
8Memory Acquisition - Linux
9Memory Acquisition - Windows
10Memory Analysis
11Patch Management & Vulnerability Scanning
12Sigma Rules
13Super TimeLine Creation
14Triage - Artifacts Collection
15Triage - Live Linux Examination
16Triage - Live Linux Examination
17Yara Rules

There are no articles to list here yet.