For the working day
The pages worth keeping open in a tab beside whatever your organisation actually runs. Not a course: the things you reach for when something is happening and somebody is waiting.
“Something is happening. What do I do first?”
6 incident types, paced by the minute, with the volatile collection ahead of the analysis because that evidence expires whether or not you were ready. Each one names the mistake people make under pressure and the instinct to resist.
“How do I make this harder to attack?”
4 guides for an estate that is already running: operating system baselines, phishing defence for a department, redaction that stays redacted, and switch port security. Every step says how to verify it actually took effect, which is the part most hardening writing leaves out.
“What should we be measuring?”
10 metrics with their formulas, where the clock starts, and what a good number looks like. Every one carries the specific way it gets gamed, usually by accident, because a metric published without its failure mode becomes a target.
“What does this artifact actually prove?”
Where evidence lives on Windows, macOS and Linux, what each source establishes, and what it does not. The playbooks link into it at the point you need each one.
“What does event 4688 actually give me?”
The lookup done more often than any other. Each one carries what it does not tell you, and whether it is on by default, because an empty result is frequently a configuration finding rather than an absence of activity.
“How do I get all of it off the host?”
One read-only PowerShell file that collects what the playbooks reference, in order of volatility, using only what ships with Windows. It writes a manifest of SHA-256 hashes, and it prints what it is doing while it does it.
“What is expiring while I read this?”
Pick what you are trying to establish and get the collection order, volatile sources first, with the trap named for each: the source people reach for that does not settle the question.
These playbooks are shaped by NIST SP 800-61, and it is worth knowing that the guidance changed. NIST withdrew Revision 2 in April 2025 and published Revision 3, which drops the four-phase lifecycle most people were taught and restructures incident response around the CSF 2.0 functions: Identify, Protect, Detect, Respond, Recover.
The practical difference is that response stops being a sequence you enter when something breaks and becomes something continuous. Most training material and most vendor diagrams still show the old cycle. If your documentation cites Rev 2, it is citing a withdrawn publication.
