What’s next? Example playbooks and how to create them
As alerts come into the security operations center (SOC), you need to find a way to streamline triage and have it done in a repeatable format. By doing so, you’ll be able to scale your team because any member can follow a pre-determined set of steps to triage. That set of steps is what is known as a playbook. There are many different formats for playbooks, such as flowcharts and bulleted/numbered lists, and we can use tools to create playbooks with a native language or Python. We'll look at a few different options in this section.
Before we can even create a playbook, we must ensure we have repeatable detection types. This might mean that you have to break down a detection to be more specific rather than general or need to establish at least a few steps of what could be normal. It helps to have a senior analyst work with a junior analyst to determine the triage steps. The senior analyst will have insights on...
