Skip to content

Incident response playbooks

Short, defensive runbooks for the incidents that fill a security team's week. Each follows the same five steps (detect, contain, eradicate, recover, lessons learned) and ends with a checklist you can copy into a ticket.

They cover what to check, cut off and report. They contain no attack steps. For the theory behind the steps, read Incident response basics first.

Playbook Use when Who usually runs it
Leaked cloud access key A key is in a repo, chat, log or scanner alert Cloud security, on-call
Phishing report triage A user reports a suspicious message SOC analyst
Suspicious OAuth app grant An unknown app was given access to a work account SOC, identity team
Ransomware, the first hour Files are being encrypted or a ransom note appears Incident commander, SOC, IT
Lost or stolen laptop A device with company access is gone Service desk, endpoint team
Publicly exposed storage bucket Storage is readable by anyone Cloud security

How to use them

  • Adapt before you need them. Put your own tool names, contacts and approval rules in a copy.
  • Practice one in a tabletop each quarter.
  • After a real incident, update the playbook the same week.
flowchart LR
  D[Detect] --> C[Contain] --> E[Eradicate] --> R[Recover] --> L[Lessons learned]
  L -.improves.-> D

The shared shape of every playbook here.