Verified response playbooks for common SOC use cases
Ten playbooks for phishing, triage, isolation, blocking, vulnerabilities and cloud containment, each verified on real devices.
soc-demo-library.zip
Sanitized by the pipeline and shipped inactive. Follow the before turning it on.
Needs a connector that isn't on the Content Hub
aws-extended, code-runner - you'll need to obtain this custom connector (or build an equivalent) before it will run.
Ten response playbooks, each run end to end against real devices before release: phishing triage, alert enrichment and dedupe, gated endpoint isolation, verified firewall blocking, impossible-travel response, vulnerability to ticket, CUI boundary containment, alert-to-case promotion, and cloud workload containment and restore.
Each one checks its own work: a block is confirmed by reading it back off the device, not trusted from the API response.
Two playbooks need connectors that aren't on the Content Hub. Install them first: AWS EC2 (Extended) for cloud containment, and Code Runner.