SOC Incident Response Playbook.

Diagram from the repository. NIST SP 800-61 groups handling into four phases; I split them into eight operational SOC steps so each maps to concrete analyst actions.

An alert fires. The analyst picks the matching playbook, fills in the standard triage fields (host, user, IP, process, hash, severity, time) on the ticket, works through the phases in order, uses the escalation table to decide when to bring in a senior analyst, and closes with lessons learned that feed back into detections.

• NIST SP 800-61
• MITRE ATT&CK
• CISA IR Playbooks (reference)
• Markdown documentation

1. CollectOriginal message with full headers
2. Review headersReturn-Path, Reply-To, Received chain, SPF/DKIM/DMARC
3. ExtractURLs, domains, attachments; SHA256 attachments; check reputation without opening
4. ScopeSearch mail logs for every recipient of the same sender/subject/URL
5. Check exposureProxy/DNS logs for visits; sign-in logs for users who entered credentials
6. Look for persistenceNew mailbox forwarding or inbox rules

Partial list. Each playbook has its full mapping in the repo.

• Splitting NIST's four phases into eight concrete steps makes each analyst action clear.
• Recording the same triage fields first makes every alert type easier to hand off and escalate.
• Preparation (logging, detection rules, access rights) decides how fast you can respond.
• Lessons learned should feed straight back into detections and playbooks.