SOC Playbook Template — Generic Incident Response

This template follows the NIST SP 800-61 and PICERL frameworks.
Duplicate and fill in for each new scenario (RDP Brute Force, Phishing, Malware, etc.)

Reference Frameworks

NIST SP 800-61 — 4 phases

Phase	Name	Description
1	Preparation	Policies, tools, and playbooks in place before any incident
2	Detection & Analysis	Triage, qualification, and scoping of the incident
3	Containment, Eradication & Recovery	Isolate, clean up, restore to normal operations
4	Post-Incident Activity	Debrief, lessons learned, continuous improvement

PICERL — 6 phases

Letter	Phase	Description
P	Preparation	Same as NIST — tools, procedures, team readiness
I	Identification	Detect and confirm the incident (triage)
C	Containment	Short-term (isolate) then long-term (patch, harden)
E	Eradication	Remove the root cause (malware, account, vulnerability)
R	Recovery	Restore and validate return to normal operations
L	Lessons Learned	Post-mortem, playbook update, process improvement

Section 1 — Metadata

Field	Value
Playbook ID	PB-XXX-000
Scenario	e.g. RDP Brute Force
Default severity	Low / Medium / High / Critical
MITRE ATT&CK	e.g. T1110.001, T1021.001
Applies to	e.g. Windows Server, endpoints
Detection source	e.g. SIEM, EDR, IDS
Author
Last updated

Section 2 — Threat Description

Describe the attack: mechanism, common tools (Hydra, Medusa, etc.), attacker objective, and enabling conditions (no NLA, no lockout policy, exposed port, etc.)

Section 3 — Detection Signals

Abnormal volume of failed authentication events (above defined threshold)
Same source IP, same targeted account
Regular interval between attempts (automated pattern)
Successful logon event in the same time window → immediate escalation

Section 4 — Triage & Qualification (Identification)

Confirm alert type and volume
Identify the source (IP, machine, user account)
Identify the target (service, account, business criticality)
Check for any successful logon event
Qualify: True Positive / False Positive / Benign

Section 5 — Containment

Block source IP at firewall or SIEM level
Disable or restrict the exposed service on the target machine
Reset the targeted account if compromise is suspected

Section 6 — Eradication

Remove the root cause (close port, apply patch, enforce controls)
Verify the source machine is not itself compromised

Section 7 — Recovery

Validate the service has returned to normal operations
Confirm no residual suspicious activity (monitor for 24h)

Section 8 — Lessons Learned & Improvement

Write the post-mortem (timeline, impact, response quality)
Update the playbook if gaps were identified
Propose improvements: SIEM rule tuning, lockout threshold, hardening

Section 9 — Escalation Criteria (L1 → L2)

Field	Value
Escalate if	Successful logon detected / internal machine compromised / admin access confirmed
Escalate to	L2 Analyst / IR Team / CISO
Max delay before escalation	e.g. 30 min after detection

IOCs Template

Type	Value	Notes
Source IP		Attacking machine
Target IP		Targeted machine
Port		Targeted service
Account		Targeted account
Event ID		Relevant Windows/Linux event
Tool		Attack tool if identified

MITRE ATT&CK Mapping

Tactic	Technique	ID

Timeline

Time	Event

Verdict & Outcome

Verdict: True Positive / False Positive / Benign
Severity justification: …
Escalated to: …

Remediation status

Action	Status
	done / monitoring / pending
	done / monitoring / pending

References: NIST SP 800-61 Rev. 2 · PICERL (SANS Institute) · MITRE ATT&CK