Playbooks
Step-by-step checklists for each type of alert. Real SOC teams work from guides like these, so read one before you take an alert.
Phishing email
Decide whether an email is a threat, find out whether anyone acted on it, and limit the damage.
6 steps · 4 practice alerts
Brute forceBrute-force login attempts
Work out whether someone guessed their way in, and what they did if they did.
6 steps · 3 practice alerts
NetworkSuspicious network activity
Tell harmless scans and blocked connections apart from a machine that is under someone else's control.
6 steps · 5 practice alerts
MalwareMalware detection
Find out whether harmful code actually ran, and how far it got.
6 steps · 10 practice alerts
Web attackWeb application attack
Decide whether an attack on a website succeeded, was blocked, or was just a scan.
6 steps · 6 practice alerts
CloudCloud and identity alerts
Decide whether an account or a cloud setting has been taken over or misused.
6 steps · 11 practice alerts
InsiderInsider and data-loss alerts
Describe unusual activity by a trusted person accurately and fairly, and hand it to the right team.
6 steps · 5 practice alerts
AIAI-era threats
Spot attacks that use AI, or that target a company's AI tools, and judge them by the evidence like any other alert.
6 steps · 7 practice alerts
Found something confusing or unrealistic?