建事应援手册
原名：building-incident-response-playbook
设计并记录结构化的事件响应剧本，包含逐步操作指南。
- 分类
- 开发提效
- 版本
- v1.0.0
- 作者
- 弈韬(@ra1nzzz)
- 下载
- 2
- 收藏
- 0
- 发布
- 2026-08-18
- 更新
- 2026-08-22
- TRACE 评分
- 3.4 / 5
内容概览
- Establishing or maturing an incident response program from scratch - Documenting procedures for a new incident type after a novel attack - Automating response workflows in a SOAR platform (Cortex XSOAR, Splunk SOAR) - Preparing for compliance audits requiring documented IR procedures (SOC 2, PCI-DSS, HIPAA) - Conducting a gap analysis of existing IR capabilities against specific threat scenarios Do not use for one-time ad hoc investigations; playbooks are reusable procedure documents, not case-specific reports. - Organizational risk assessment identifying top incident scenarios by likelihood and impact - NIST SP 800-61r3 or SANS PICERL framework adopted as the organizational IR standard - Asset inventory with business criticality ratings and data classification - RACI chart defining roles: Incident Commander, SOC analysts, system administrators, legal, communications - Existing detecti…