PB-CIRP-101
Enterprise ITPhishing and Business Email Compromise
Phishing, ransomware, account compromise — the everyday IR set.
Pre-built playbooks & runbooks. Open one to a live case.
Every playbook ships with a one-click handoff to the platform. Hit Open incident or Open exposure and the case is created with the right policy attached, the right RASCI assigned, and the activity log already running.
PB-CIRP-102
Enterprise ITEndpoint Malware Detection
Phishing, ransomware, account compromise — the everyday IR set.
PB-CIRP-103
Enterprise ITRansomware
Phishing, ransomware, account compromise — the everyday IR set.
PB-CIRP-104
Enterprise ITAccount Compromise Mfa Bypass
Phishing, ransomware, account compromise — the everyday IR set.
PB-CIRP-105
Enterprise ITData Exfiltration
Phishing, ransomware, account compromise — the everyday IR set.
PB-CIRP-106
Enterprise ITInsider Threat Malicious
Phishing, ransomware, account compromise — the everyday IR set.
PB-CIRP-107
Enterprise ITPrivileged Account Abuse
Phishing, ransomware, account compromise — the everyday IR set.
PB-CIRP-108
Enterprise ITLateral Movement Detection
Phishing, ransomware, account compromise — the everyday IR set.
PB-CIRP-109
Enterprise ITDestructive Malware Wiper
Phishing, ransomware, account compromise — the everyday IR set.
PB-CIRP-110
Enterprise ITUnauthorised Software Tool Deployment
Phishing, ransomware, account compromise — the everyday IR set.
PB-CIRP-201
Cloud & SaaSAWS Account Compromise
AWS, Azure, M365, OAuth, Kubernetes, serverless.
PB-CIRP-202
Cloud & SaaSM365 Entra Id Compromise
AWS, Azure, M365, OAuth, Kubernetes, serverless.
PB-CIRP-203
Cloud & SaaSOAUTH Saas Token Abuse
AWS, Azure, M365, OAuth, Kubernetes, serverless.
PB-CIRP-204
Cloud & SaaSCloud Storage Data Leak s3 Azure Blob GCS
AWS, Azure, M365, OAuth, Kubernetes, serverless.
PB-CIRP-205
Cloud & SaaSContainer Kubernetes Compromise
AWS, Azure, M365, OAuth, Kubernetes, serverless.
PB-CIRP-206
Cloud & SaaSServerless Function Abuse
AWS, Azure, M365, OAuth, Kubernetes, serverless.
PB-CIRP-207
Cloud & SaaSCloud Management Plane Compromise
AWS, Azure, M365, OAuth, Kubernetes, serverless.
PB-CIRP-208
Cloud & SaaSCloud IAM Misconfiguration Exploitation
AWS, Azure, M365, OAuth, Kubernetes, serverless.
PB-CIRP-301
OT / ICSSCADA PLC Compromise
SCADA, PLC, HMI, safety systems, IT-to-OT pivot.
PB-CIRP-302
OT / ICSProcess Anomaly Unexplained Behaviour
SCADA, PLC, HMI, safety systems, IT-to-OT pivot.
PB-CIRP-303
OT / ICSOT Network Isolation
SCADA, PLC, HMI, safety systems, IT-to-OT pivot.
PB-CIRP-304
OT / ICSSafety Instrumented System Event
SCADA, PLC, HMI, safety systems, IT-to-OT pivot.
PB-CIRP-305
OT / ICSEngineering Workstation Compromise
SCADA, PLC, HMI, safety systems, IT-to-OT pivot.
PB-CIRP-306
OT / ICSHMI Tampering
SCADA, PLC, HMI, safety systems, IT-to-OT pivot.
Showing 24 of 98 matching playbooks (98 total). The library is regenerated from the policy-architecture repo on every deploy via scripts/sync-playbooks.py.
Want to fork a playbook? Every artefact is yours from day one.
Templates ship in the box. You customise, version, and own your copy. We update the upstream library; you choose when to merge.