Top 5
Playbooks.
Templates to ship first — for maximum impact across the most common incident types.
These five playbooks cover the highest-volume, highest-impact incidents your program will face. Each template provides a frame you can adapt to your tools and tenants. Start with Playbook 01 — it gives you a fighting chance against both ransomware and credential theft on day one.
Five playbooks. One pattern. Different muscles.
Each follows the same anatomy — Severity, Trigger, RS level, Owner, Immediate Actions, Investigation, Recovery — so the team builds one mental model and applies it everywhere.
| # | Playbook | Use case | Severity | RS |
|---|---|---|---|---|
| 01 | Endpoint Quarantine + Identity Revoke | Ransomware · Stolen Credentials | P1 / Critical | RS-2 |
| 02 | Phishing Burst Response | Mass phishing campaign | P2 / High | RS-1 |
| 03 | SaaS Consent Kill | Risky OAuth app consent | P2 / High | RS-2 |
| 04 | Stolen Credential Response | Compromised account | P2 / High | RS-2 |
| 05 | Data Exfiltration Suspect | Unusual data transfer | P1–P2 | RS-3 |
Easily reversible
Auto-execute. Quarantined emails restorable, blocklists revertible.
Reversible with effort
Auto-execute by default. Isolation lifts, tokens reissue, accounts re-enable.
Approval required
Human gate. Egress blocks, deletions, business-impacting actions.
Endpoint Quarantine + Identity Revoke
Immediate actions — first 15 minutes
- Isolate. Use EDR to network-isolate the host. Stops lateral movement.
- Identify. Determine which user was logged in and what credentials may be compromised.
- Revoke. In the IdP (Entra ID, Okta, etc.), revoke all active sessions for the user.
- Disable. Temporarily disable the account to prevent re-authentication.
- Notify. Alert the Incident Commander and create the incident ticket.
Investigation
- Collect a memory image from the isolated endpoint, if possible.
- Review the EDR timeline for initial access vector.
- Check SIEM for lateral-movement indicators.
- Determine scope — how many endpoints, how many users.
- Verify backup integrity. Are they intact?
Recovery
- Rebuild the affected endpoint from a known-good image.
- Reset the user password with a strong, unique credential.
- Re-enable the account with MFA verification.
- Restore files from immutable backup if needed.
- Monitor 48 – 72 hours for re-infection indicators.
Phishing Burst Response
Immediate actions
- Identify. Phishing indicators — sender, subject, URLs, attachment hashes.
- Search. Use eDiscovery / Content Search to locate every instance.
- Quarantine. Remove all instances from user mailboxes.
- Block. Add sender / domain to the email gateway blocklist.
- Notify. Send a company-wide alert about the campaign.
Assess impact
- Check email logs — who received it, opened it, clicked.
- If credentials entered → execute Playbook 04.
- If malware downloaded → execute Playbook 01.
- Contact users who clicked for additional investigation.
SaaS Consent Kill
Immediate actions
- Identify. App name, publisher, permissions requested (SPNs / scopes).
- Enumerate. How many users granted consent to this app.
- Revoke. Remove app permissions for all affected users.
- Rotate. If enterprise app, rotate any secrets or certificates.
- Block. Add the application to the IdP blocklist.
- Notify. Alert data owners whose data may have been accessed.
Investigation
- Review app activity logs — what data was accessed.
- Check for data-exfiltration indicators.
- If consent was granted via phishing → execute Playbook 02.
Stolen Credential Response
Immediate actions
- Revoke. Terminate all active sessions for the user.
- Reset. Force a new password on next login.
- Step up. Force MFA re-enrollment or verification.
- Review. Check sign-in logs for suspicious access.
- Persist? Look for new MFA devices, app passwords, forwarding rules.
If a privileged account
- Disable the account immediately.
- Audit all actions taken with privileged access.
- Check for new admin accounts created.
- Review changes to security configurations.
- Consider rotating service-account credentials.
Data Exfiltration Suspect
Immediate actions
- Identify. Source system, destination, user, volume, data type.
- Assess. Is this authorized? Check with the data owner.
- Block. If unauthorized, block destination IP / domain at the firewall.
- Preserve. Capture network logs, DLP alerts, user activity.
- Notify. Alert owner of affected data and systems.
- Engage. Legal / HR if insider threat is suspected.
Investigation questions
- What data was transferred? (Classification level)
- How much? (Volume and record count)
- Where did it go? (External destination analysis)
- Is this a breach? (Regulatory notification requirements)
- Was this malicious or accidental?
Customize these templates. Add tool-specific commands, name owners, run them under fire — and only then trust them.
Where this connects
These playbooks operationalize the Act step of the Calm Loop (Doc 01) and become reflexes inside the Walk phase (Doc 02). The 30/60/90 plan (Doc 04) ships them in this order — start with 01.