For the working day
The pages worth keeping open in a tab beside whatever your organisation actually runs. Not a course: the things you reach for when something is happening and somebody is waiting.
“Where are the plans, the rules and the scripts?”
18 entries across four shelves: full-lifecycle response plans, Sigma and YARA rules with their false positives stated, artifact cheat sheets, and triage scripts hosted in plain text. Every entry is versioned, cited and carries a provenance label.
“The alert just fired. What do I do in the next fifteen minutes?”
Tickable checklists for high-severity alerts: three windows, a few lines in each, the instinct to resist, and a hand-off to the playbook that takes it from minute sixteen. Nothing is stored and nothing is sent.
“What should I hunt for today, in the console I have?”
Copy-and-paste hunts in KQL, SPL and Elastic, filtered by language and ATT&CK tactic. Each is time-bounded, names the benign things it returns, and says whether it has ever been run.
“What is this blob, and how do I read it?”
Decoding and deobfuscation recipes as JSON you load rather than retype, each with a constructed sample and the output it should produce.
“Something is happening. What do I do first?”
26 incident types, paced by the minute, with the volatile collection ahead of the analysis because that evidence expires whether or not you were ready. Each one names the mistake people make under pressure and the instinct to resist.
“How do I make this harder to attack?”
4 guides for an estate that is already running: operating system baselines, phishing defence for a department, redaction that stays redacted, and switch port security. Every step says how to verify it actually took effect, which is the part most hardening writing leaves out.
“What should we be measuring?”
10 metrics with their formulas, where the clock starts, and what a good number looks like. Every one carries the specific way it gets gamed, usually by accident, because a metric published without its failure mode becomes a target.
“What does this artifact actually prove?”
Where evidence lives on Windows, macOS and Linux, what each source establishes, and what it does not. The playbooks link into it at the point you need each one.
“What does event 4688 actually give me?”
The lookup done more often than any other. Each one carries what it does not tell you, and whether it is on by default, because an empty result is frequently a configuration finding rather than an absence of activity.
“How do I get all of it off the host?”
One read-only PowerShell file that collects what the playbooks reference, in order of volatility, using only what ships with Windows. It writes a manifest of SHA-256 hashes, and it prints what it is doing while it does it.
“What is expiring while I read this?”
Pick what you are trying to establish and get the collection order, volatile sources first, with the trap named for each: the source people reach for that does not settle the question.
These playbooks are shaped by NIST SP 800-61, and it is worth knowing that the guidance changed. NIST withdrew Revision 2 in April 2025 and published Revision 3, which drops the four-phase lifecycle most people were taught and restructures incident response around the CSF 2.0 functions: Identify, Protect, Detect, Respond, Recover.
The practical difference is that response stops being a sequence you enter when something breaks and becomes something continuous. Most training material and most vendor diagrams still show the old cycle. If your documentation cites Rev 2, it is citing a withdrawn publication.
