Incident-Playbook

SIEM book

If you have an idea for the project please start a discusssion.

PURPOSE OF PROJECT

That this project will be created by the SOC/Incident Response Community

• Develop a Catalog of Incident Response Playbook for every MITRE Technique (Keep in mind it won’t work for some tactics).
• Develop a Catalog of Incident Response Playbook for uncommon incidents.
• Develop a Catalog of Exercise Scenarios that can be used for training purposes.
• Develop a Catalog of tools used for Incident Response [Plus Reviews for the different tools].
• Develop a Catalog of Incident Response Automations.
• Develop a Catalog of Checklists [For Before, During, After Incidents].
• Develop a Catalog of Roles that a organization can use, to build their own program.
• Develop a Catalog of Event Codes and API Actions that you can/will see in a SIEM Detections.

---

For every pull request submitted a issue must also be created.

• Please Read Creating a New Playbook;
• Check the list of MITRE Techniques to choose from and create a new issue;
• Or you can just look at the list of issues that are ready to be worked on.

Incident Response Phases

Contributors

Going to list all users contribute here.