Defender playbooks are the documented procedures for handling specific scenarios. Mature SOCs have dozens of playbooks; most organizations have far fewer than they should. Among the playbooks every defender should have ready, here are 7 that address scenarios that come up frequently and that benefit substantially from pre-planning. For each, I'll describe what the playbook addresses, what the key elements are, and how to test it.
1. Suspected phishing email reported by a user
The most-common defender play. Users report suspicious emails routinely; the response should be efficient and effective.
What the playbook covers: intake of the user report, analysis of the email (sender, content, attachments, links), determination of whether the email is malicious, search for other recipients, removal from inboxes if malicious, communication back to the user, lessons learned.
Key elements:
- Standardized intake (button in email client that submits to security)
- Analysis tools (sandbox for attachments, link analysis)
- Investigation playbook for determining scope
- Removal procedures (mass-purge from all inboxes)
- User communication template
How to test: phishing simulation that submits a "report" to the SOC. Measure time to analysis, accuracy of classification, completeness of removal. Periodic refresh as phishing tactics evolve.
2. Account compromise indicators detected
Signs of compromised user accounts (impossible travel, unusual access patterns, MFA fatigue) require structured response.
What the playbook covers: verification of the indicator, immediate containment (suspend account, force re-authentication), investigation of the compromise scope, password reset and MFA reset, communication to the affected user, post-incident review.
Key elements:
- Threshold definitions for what triggers the playbook
- Coordination with IT for account suspension
- Investigation procedures for determining what the attacker did
- User notification and re-authentication procedures
- Forensic data preservation
How to test: simulated account compromise scenario. Walk through the playbook with the team. Measure time from detection to containment, completeness of investigation.
3. Ransomware indicators detected
Early ransomware indicators (mass file modifications, ransomware command-and-control traffic, ransom notes) require immediate aggressive response.
What the playbook covers: verification, immediate isolation of affected systems, broader containment to prevent spread, executive notification, evidence preservation, recovery planning, post-incident analysis.
Key elements:
- Rapid isolation procedures (network disconnection, account suspension)
- Backup verification and restoration procedures
- External coordination (IR provider, law enforcement, cyber insurance)
- Communication procedures for various stakeholder groups
- Decision tree for ransom payment considerations (typically: don't pay, but document the decision process)
How to test: tabletop exercise simulating ransomware deployment. Test technical procedures, decision processes, communication procedures, recovery procedures. Repeat annually with variations.
4. Supply chain compromise indicators
Indicators that a vendor or supplier has been compromised require investigation of potential impact on your organization.
What the playbook covers: verification of the supplier compromise, assessment of your organization's exposure, containment of any propagated impact, communication with the supplier and other affected parties, ongoing monitoring.
Key elements:
- Vendor risk register with critical vendor mapping
- Communication procedures with vendors during their incidents
- Investigation procedures for indirect compromise
- Mitigation procedures for various exposure scenarios
- Documentation requirements for regulatory reporting if applicable
How to test: tabletop exercise simulating a major vendor compromise. Test the assessment, containment, and communication procedures.
5. Insider threat indicators
Indicators of insider threat (data exfiltration patterns, unusual access, employees in sensitive transition periods) require careful response that preserves both security and employee rights.
What the playbook covers: verification of indicators, coordination with HR and legal before action, investigation procedures that preserve evidence and rights, intervention options (monitoring, restricted access, termination), post-incident review.
Key elements:
- HR and legal involvement requirements
- Evidence preservation procedures
- Confidentiality requirements during investigation
- Decision tree for intervention options
- Communication restrictions during sensitive investigations
How to test: tabletop exercise with HR and legal participation. Walk through scenarios that test the coordination procedures.
6. Distributed denial of service (DDoS) attack
DDoS attacks against external services require rapid technical response and clear communication.
What the playbook covers: detection and verification of the attack, traffic analysis, mitigation activation (CDN protection, ISP coordination), communication to affected users, post-attack analysis.
Key elements:
- Pre-arranged DDoS mitigation services with tested activation procedures
- Coordination procedures with hosting providers and CDNs
- Communication templates for service status updates
- Investigation procedures for determining attack source and motivation
- Decision criteria for whether to extend protection or accept partial outage
How to test: coordinate with DDoS mitigation provider for a test activation. Verify procedures work as expected. Test communication procedures with realistic timing.
7. Web application compromise (defacement, data theft, malicious code injection)
Web application compromises require rapid response that includes both technical containment and customer communication.
What the playbook covers: verification of the compromise, immediate containment (taking the application offline if necessary), investigation of the compromise scope, customer notification if data was exposed, recovery and re-deployment, post-incident security improvements.
Key elements:
- Application isolation procedures
- Forensic procedures for web applications (log preservation, image capture)
- Customer notification procedures (when, how, what to say)
- Coordination with development team for remediation
- Re-deployment procedures with security validation
How to test: tabletop exercise simulating web application compromise. Walk through technical, communication, and coordination procedures.
What playbooks should look like
Effective playbooks share several characteristics:
- Specific actions, not abstract guidance. "Block the IP at the perimeter firewall" beats "implement appropriate network controls."
- Decision trees for branching scenarios. Most incidents don't follow a single path; the playbook should guide decision-making.
- Roles and accountabilities. Who does what, who approves what, who communicates what.
- Communication templates. Pre-drafted notifications that need only customization for the specific incident.
- Tool integration. Reference specific tools and how to use them, not generic descriptions.
- Testing procedures. How to verify the playbook works.
The maintenance discipline
Playbooks degrade if not maintained. The procedures, tools, and contacts referenced become outdated. The threats they address evolve.
Recommended maintenance:
- Annual review of all playbooks
- Update after any incident that exposed playbook gaps
- Update when tools or processes change
- Tabletop exercises that test playbook accuracy
- Documentation of playbook changes and rationale
The starting point
Organizations without mature playbook libraries should start with the highest-frequency scenarios. For most organizations, the priority order:
- Phishing email response (most common)
- Account compromise response (frequent)
- Ransomware response (high impact when it occurs)
- Web application compromise (significant exposure)
- Insider threat (sensitive coordination requirements)
- Supply chain compromise (increasing frequency)
- DDoS attack (relatively predictable response)
Building one playbook per quarter produces a comprehensive library within two years. The investment is modest; the operational benefit is substantial.
The takeaway
Defender playbooks make incident response faster, more consistent, and more effective. The 7 above address scenarios that virtually every organization will face. For organizations without mature playbook libraries, building these is among the highest-leverage security investments available.
Audit your current playbook library against the list. Build the missing ones. Test what you have. The work compounds across years of more-effective security operations.
