PB-CIRP-101
Enterprise ITPhishing and Business Email Compromise
Phishing, ransomware, account compromise — the everyday IR set.
Pre-built playbooks & runbooks. Open one to a live case.
Every playbook ships with a one-click handoff to the platform. Hit Open incident or Open exposure and the case is created with the right policy attached, the right RASCI assigned, and the activity log already running.
PB-CIRP-102
Enterprise ITEndpoint Malware Detection
Phishing, ransomware, account compromise — the everyday IR set.
PB-CIRP-103
Enterprise ITRansomware
Phishing, ransomware, account compromise — the everyday IR set.
PB-CIRP-104
Enterprise ITAccount Compromise Mfa Bypass
Phishing, ransomware, account compromise — the everyday IR set.
PB-CIRP-105
Enterprise ITData Exfiltration
Phishing, ransomware, account compromise — the everyday IR set.
PB-CIRP-106
Enterprise ITInsider Threat Malicious
Phishing, ransomware, account compromise — the everyday IR set.
PB-CIRP-107
Enterprise ITPrivileged Account Abuse
Phishing, ransomware, account compromise — the everyday IR set.
PB-CIRP-108
Enterprise ITLateral Movement Detection
Phishing, ransomware, account compromise — the everyday IR set.
PB-CIRP-109
Enterprise ITDestructive Malware Wiper
Phishing, ransomware, account compromise — the everyday IR set.
PB-CIRP-110
Enterprise ITUnauthorised Software Tool Deployment
Phishing, ransomware, account compromise — the everyday IR set.
PB-CIRP-111
Enterprise ITWeb Shell Deployment and Server Side Persistence
Phishing, ransomware, account compromise — the everyday IR set.
PB-CIRP-112
Enterprise ITC2 Beaconing and Command and Control Channel Detection
Phishing, ransomware, account compromise — the everyday IR set.
PB-CIRP-113
Enterprise ITLiving Off The Land Lolbin Abuse
Phishing, ransomware, account compromise — the everyday IR set.
PB-CIRP-114
Enterprise ITCredential Dumping Lsass Sam Dcsync Ntds Dit
Phishing, ransomware, account compromise — the everyday IR set.
PB-CIRP-115
Enterprise ITPass The Hash Pass The Ticket Token Impersonation
Phishing, ransomware, account compromise — the everyday IR set.
PB-CIRP-116
Enterprise ITDNS Based Attack Tunneling Hijacking Fast Flux C2
Phishing, ransomware, account compromise — the everyday IR set.
PB-CIRP-117
Enterprise ITFileless Memory Resident Malware
Phishing, ransomware, account compromise — the everyday IR set.
PB-CIRP-118
Enterprise ITBrowser Compromise Malicious Extension or Session Token Theft
Phishing, ransomware, account compromise — the everyday IR set.
PB-CIRP-119
Enterprise ITUsb Removable Media Security Incident
Phishing, ransomware, account compromise — the everyday IR set.
PB-CIRP-120
Enterprise ITPersistence Mechanism Discovery Scheduled Task Registry Wmi Subscription
Phishing, ransomware, account compromise — the everyday IR set.
PB-CIRP-121
Enterprise ITActive Directory Enumeration and Attack Path Exploitation
Phishing, ransomware, account compromise — the everyday IR set.
PB-CIRP-122
Enterprise ITEmail Delivered Malware Macro Lnk Iso Html Smuggling
Phishing, ransomware, account compromise — the everyday IR set.
PB-CIRP-123
Enterprise ITPrint Spooler or Windows Service Exploitation for Privilege Escalation
Phishing, ransomware, account compromise — the everyday IR set.
PB-CIRP-124
Enterprise ITWeb Application Exploitation Sqli Ssti Deserialisation Ssrf
Phishing, ransomware, account compromise — the everyday IR set.
Showing 24 of 244 matching playbooks (244 total — 161 standard, 83 premium). The library is regenerated from the policy-architecture repo on every deploy via scripts/sync-playbooks.py.
Want to fork a playbook? Every artefact is yours from day one.
Templates ship in the box. You customise, version, and own your copy. We update the upstream library; you choose when to merge.