Arcana
IR documentation · offline copy
Nederlands
Overview
About playbooks
About runbooks
Playbooks
19
PB-001: Phishing & Credential Theft
PB-002: Ransomware Incident Response
PB-003: Endpoint Malware Infection
PB-004: Account Takeover
PB-005: Data Exfiltration
PB-006-insider-threat
PB-007: Cloud Compromise
PB-008: Web Application Attack
PB-009: Privilege Escalation
PB-010: Lateral Movement
PB-011: Suspicious Execution
PB-012: Third-Party Compromise
PB-013: Distributed Denial of Service (DDoS)
PB-014: Lost & Stolen Device
PB-015: Active Exploitation
PB-016: Business Email Compromise
PB-017: Vulnerability Response
PB-018: Zero-Day Response
PB-019: Major Security Incident Management
Runbooks · Triage
12
RB-TRIAGE-001: Email Triage & Header Analysis
RB-TRIAGE-002: EDR Alert Triage
RB-TRIAGE-003: Identity Alert Triage
RB-TRIAGE-004: Third-Party Notification Validation
RB-TRIAGE-005: DDoS Alert Validation
RB-TRIAGE-006: Lost & Stolen Device Validation
RB-TRIAGE-007: Active Exploitation Validation
RB-TRIAGE-008: Business Email Compromise Validation
RB-TRIAGE-009: Vulnerability Validation
RB-TRIAGE-010: Suspected Data Loss Triage
RB-TRIAGE-011: Cloud Platform Alert Triage
RB-TRIAGE-012: Web Application Attack Triage
Runbooks · Evidence
6
RB-EVIDENCE-001: Memory Acquisition
RB-EVIDENCE-002: Host-Based Log Acquisition
RB-EVIDENCE-003: Identity & Authentication Log Acquisition
RB-EVIDENCE-004: Cloud Control Plane Log Acquisition
RB-EVIDENCE-005: Cloud Workload Snapshot Acquisition
RB-EVIDENCE-006: Web Application Log Acquisition
Runbooks · Analysis
44
RB-ANALYSIS-001: URL Analysis
RB-ANALYSIS-002: Phishing Retro Hunt
RB-ANALYSIS-003: Identify Patient Zero
RB-ANALYSIS-004: Ransomware Encryption Scope Assessment
RB-ANALYSIS-005: Threat Actor TTP Mapping
RB-ANALYSIS-006: Process Tree Analysis
RB-ANALYSIS-007: Authentication Log Analysis
RB-ANALYSIS-008: OAuth & Application Consent Review
RB-ANALYSIS-009: Privileged Access Assessment
RB-ANALYSIS-010: Credential Exposure Investigation
RB-ANALYSIS-011: Identify Additional Compromised Accounts
RB-ANALYSIS-012: Phishing Interaction Validation
RB-ANALYSIS-013: Ransomware Payload Analysis
RB-ANALYSIS-014: Malware Persistence Mechanism Hunt
RB-ANALYSIS-015: Malware Analysis
RB-ANALYSIS-016: Memory Analysis
RB-ANALYSIS-017: Backup Integrity & Recovery Viability Assessment
RB-ANALYSIS-018: Outbound Traffic Analysis
RB-ANALYSIS-019: Data Staging Investigation
RB-ANALYSIS-020: Cloud Storage & SaaS Review
RB-ANALYSIS-021: Sensitive Data Impact Assessment
RB-ANALYSIS-022: Exfiltration Scoping Hunt
RB-ANALYSIS-023: Command-Line Analysis
RB-ANALYSIS-024: LOLBin Abuse Investigation
RB-ANALYSIS-025: Script Execution Analysis
RB-ANALYSIS-026: User Activity Validation
RB-ANALYSIS-027: Third-Party Exposure Assessment
RB-ANALYSIS-028: Supply Chain Impact Analysis
RB-ANALYSIS-029: DDoS Traffic Analysis
RB-ANALYSIS-030: DDoS Service Impact Assessment
RB-ANALYSIS-031: DDoS Attribution & Threat Assessment
RB-ANALYSIS-032: Device Security Posture Assessment
RB-ANALYSIS-033: Device Data Exposure Assessment
RB-ANALYSIS-034: Exploitation Activity Analysis
RB-ANALYSIS-035: Affected Asset Identification
RB-ANALYSIS-036: Mailbox Compromise Investigation
RB-ANALYSIS-037: Mail Forwarding & Inbox Rule Analysis
RB-ANALYSIS-038: Financial Fraud Impact Assessment
RB-ANALYSIS-039: Vulnerability Exposure Assessment
RB-ANALYSIS-040: Vulnerable Asset Identification
RB-ANALYSIS-041: Exploitation Verification
RB-ANALYSIS-042: Vulnerability Threat Intelligence Assessment
RB-ANALYSIS-043: Cloud Control Plane Activity Analysis
RB-ANALYSIS-044: Web Application Attack Analysis
Runbooks · Contain
16
RB-CONTAIN-001: Account Lockdown
RB-CONTAIN-002: Rapid Containment & Network Segmentation
RB-CONTAIN-003: Active Directory Containment
RB-CONTAIN-004: Host Isolation
RB-CONTAIN-005: Session & Token Revocation
RB-CONTAIN-006: MFA Reset & Validation
RB-CONTAIN-007: Outbound Transfer Blocking
RB-CONTAIN-008: Third-Party Access Restriction
RB-CONTAIN-009: DDoS Mitigation Activation
RB-CONTAIN-010: Traffic Filtering & Rate Limiting
RB-CONTAIN-011: Remote Device Lock & Wipe
RB-CONTAIN-012: Exploitation Surface Containment
RB-CONTAIN-013: BEC Mailbox Containment
RB-CONTAIN-014: Vulnerability Exposure Reduction
RB-CONTAIN-015: Cloud Workload Isolation
RB-CONTAIN-016: Web Application Access Restriction
Runbooks · Eradication
1
RB-ERAD-001: Email Removal & Blocking
Runbooks · Recovery
7
RB-RECOVERY-001: Recovery & Restoration Coordination
RB-RECOVERY-002: Clean System Rebuild
RB-RECOVERY-003: User Recovery & Access Restoration
RB-RECOVERY-004: Exposure Mitigation
RB-RECOVERY-005: Third-Party Trust Restoration
RB-RECOVERY-006: Service Availability Restoration
RB-RECOVERY-007: Vulnerability Remediation Validation
Runbooks · Post-incident
4
RB-POST-001: Ransomware-Post-Incident Hardening
RB-POST-002: Data Exfiltration Hardening
RB-POST-003: DDoS Resilience Improvement
RB-POST-004: Web Application Security Hardening
SOPs
7
SOP-001-Paging an Engineering Team's On-Call for Security Incidents
SOP-002: Incident Handoff Between Geos
SOP-003: Escalation, Legal & Executive Communications
SOP-004: User Notification During a Security Incident
SOP-005: Vendor Communication During a Security Incident
SOP-006: Employee Verification During a Security Incident
SOP-007: Major Incident War Room Management
Templates
5
Incident Response Plan (IRP) Template
KB-000-<Document Name>
PB-000-<Document Name>
RB-000-<Document Name>
SOP-000-<Document Name>