SOC Runbooks

Standard operating procedures for security operations. Gives the agent structured playbooks for common incident types with step-by-step response procedures, decision points, and escalation triggers.

Contents

• Phishing Response

  • Email header analysis and sender verification
  • URL and attachment sandboxing checklist
  • User notification and credential reset procedure
  • Block sender and quarantine similar messages
  • Metrics: time to quarantine, users who clicked, credentials compromised

• Malware Incident

  • Host isolation procedure (network isolation vs full containment)
  • Process tree analysis and persistence mechanism identification
  • IOC extraction (file hashes, network indicators, registry keys)
  • Remediation steps by malware category (ransomware, RAT, cryptominer)
  • Re-image vs clean decision criteria

• Unauthorized Access

  • Session enumeration and termination procedure
  • Privilege audit: what did the account access?
  • Credential reset and MFA re-enrollment
  • Access revocation across all connected systems
  • Root cause analysis: compromised password, session hijacking, or privilege escalation?

• Data Exfiltration

  • Scope assessment: what data, how much, where did it go?
  • Data classification (PII, financial, IP, credentials)
  • Legal notification requirements by data type and jurisdiction
  • Containment: block exfiltration channel, revoke access
  • Evidence preservation for potential legal action

• Brute Force Attack

  • Account lockout review and source IP analysis
  • Credential stuffing vs targeted brute force differentiation
  • Source blocking (IP, subnet, ASN)
  • Password policy assessment and enforcement
  • Monitoring for successful authentications from attack source

• Insider Threat

  • Activity timeline construction (file access, email, print, USB)
  • Data access audit: what sensitive data was accessed?
  • HR coordination procedure and legal hold requirements
  • Evidence preservation chain of custody
  • Graduated response: monitoring → access restriction → termination

How the agent uses this

During incident investigation, the agent loads the relevant runbook to guide its response. Each runbook defines:

1. Required data collection steps (which systems to query)
2. Decision points (when to escalate, when to contain)
3. Escalation triggers (data classification, affected user count, regulatory implications)
4. Documentation requirements (what to record for the incident report)
5. Post-incident actions (KB updates, detection rule improvements)

The agent follows the runbook steps but applies judgment about which steps to parallelize (dispatch multiple task agents) and which require sequential execution.