Response playbooks
Review threat-specific procedures, bind approvals, execute bounded actions, and handle partial failure.
Playbooks define reviewed response steps for a threat category. They combine investigation guidance, approval gates, and optional executable actions; reading a playbook does not grant response authority.
Create a playbook
At Incidents → Playbooks → Create, select a category such as DDoS, suspected endpoint compromise, credential misuse, or suspected data loss. Define triggers, required observations, owner, permitted asset groups, ordered steps, approval rules, timeout, and verification. Include a recovery step for every disruptive control.
A draft has no execution effect. Use Playbook → Test with synthetic observations in a pilot incident, review the target preview, then Publish an immutable revision. The test preview identifies executable actions before a responder authorizes them. Each incident run pins a playbook revision so later edits cannot change already reviewed instructions.
Guided and automatic execution
A guided step shows its console entry point and required evidence; a responder records its outcome. An executable step creates a response action with explicit target IDs, parameters, deadline, and approval requirement. Default execution is guided. Automatic execution requires an Administrator's explicit enablement and the response-control grant for its target set.
At Incident → Playbook run, inspect steps as pending, running, succeeded, failed, or skipped. Skipped steps require a reason. A failed required action stops dependent steps; it cannot be converted to success by a note saying the incident is contained. Independent investigation steps can continue when they do not depend on the failed action.
Cancel and revise
Open Incident → Playbook run and select Stop to prevent new steps from starting. Open each running step's action record to check its operation. If the operation reports cancelable=true, use Operation → Cancel and wait for its terminal result. If it is not cancelable, follow its progress and record the final per-target outcome.
Stopping the run leaves completed controls applied. To undo endpoint containment, request Release isolation or quarantine restoration and verify the agent's acknowledgement. For a firewall change, publish the reviewed replacement policy and check gateway adoption under Policies → Policy → Adoption.
To change the procedure for later incidents, open Incidents → Playbooks, select the playbook, and create a new draft. Publish it after review. Active incidents keep their pinned revision unless a responder starts a reviewed replacement run.
Include failed approvals, offline targets, and controls left active in the post-incident report.