Incident Response Playbooks

Step-by-step workflows for cybersecurity incident response

Showing 12 of 12 playbooks

Malware Infection Response

Comprehensive response to malware incidents including containment, eradication, and recovery

High Priority

2-8 hours

Phishing Attack Response

Handle credential harvesting and email-based attacks

Medium Priority

1-4 hours

Data Breach Response

Respond to unauthorized access or exfiltration of sensitive data

Critical Priority

4-24 hours

DDoS Attack Mitigation

Respond to distributed denial of service attacks

High Priority

1-6 hours

Insider Threat Investigation

Investigate suspicious activity by internal users

High Priority

8-24 hours

Ransomware Response

Comprehensive response to ransomware encryption attacks

Critical Priority

6-48 hours

AI/LLM Security Incident Response

Respond to prompt injection, model/data poisoning, and sensitive-data leakage in AI and LLM systems

High Priority

2-12 hours

OT/ICS Security Incident Response

Respond to operational technology and SCADA incidents while preserving safety and process integrity

Critical Priority

4-48 hours

Web Application Attack Response

Respond to web exploitation such as SQL injection, XSS, authentication bypass, and web shells

High Priority

2-8 hours

Network Intrusion & Lateral Movement Response

Respond to post-compromise network intrusions involving credential abuse and lateral movement

Critical Priority

4-24 hours

Cloud Security Incident Response

Respond to cloud account and workload compromise including IAM abuse, exposed storage, and cryptomining

Critical Priority

2-12 hours

Supply-Chain Compromise Response

Respond to third-party, dependency, or software supply-chain compromises affecting the build and delivery pipeline

Critical Priority

8-72 hours

Critical

High Priority

Total Playbooks