domains / families / security / building-incident-response-playbook

building-incident-response-playbook

separate

Designs and documents structured incident response playbooks with step-by-step

When to use

• Establishing or maturing an incident response program from scratch
• Documenting procedures for a new incident type after a novel attack
• Automating response workflows in a SOAR platform (Cortex XSOAR, Splunk SOAR)
• Preparing for compliance audits requiring documented IR procedures (SOC 2, PCI-DSS, HIPAA)
• Conducting a gap analysis of existing IR capabilities against specific threat scenarios

When not to use

• One-time ad hoc investigations
• Case-specific reports

Skill page

Source