PROCESS ORIENTED PLAYBOOKS
Our Playbooks are shareable, tool agnostic and process focused. They describe what to do.
Flexible IR moving towards a grey market for community driven Playbooks.
The Grand Vision for Playbooks: Organizations wouldn’t need to create their own playbooks (although certainly welcome to). But rather there would be a community repository for playbooks that organizations can pull from and tailor to meet their needs. New playbooks and updates to existing ones would be community-driven. Leverage the community to handle harder issues.
Shareable and tool agnostic Playbooks
FlexibleIR Playbooks are process oriented describing what tasks to do. Each task becomes a card on the Kanban boards and can be granularly analysed. Each task will have owner, average time consumed, flags like mandatory or optional, compliance mappings, checklists, comments and subtasks. Playbooks are process focused and do NOT show logic – that’s where workflows come into play.
The primary focus is for expert analysts to create playbooks within minutes and minimum rampup. Simple productivity tooks like trello boards and excel used. Also the playbook is designed for a human to read easily.
Phishing Playbook
Community driven - From a major infrastructure company.
DDos Playbook
Community driven - From Societe Generale - A French investment bank and financial services company.
Malicious Code (malware) Playbook
Community driven - From a major infrastructure company.
Events Specific Playbooks.
Example of an SIEM event specific case - Firewall connection blocked playbook.
Key Features
Meeting Compliance Requirements
Playbooks are key to help meet compliance requirements (e.g., “I keep failing these X security controls. Which playbooks can I use to help bridge the gap?”).
Smarter Buying from SOAR vendor
Playbooks help an organization identify where their gaps in capabilities are. Once identified, they can go to vendors to ask them specifically and clearly, “Does your product meet these needs?”
Documenting Dependencies
Playbooks can point to other parts of the organization (or maybe even other organizations) that they have a dependency on, and they need help. (e.g., “I keep failing this process! Oh, I see in my playbook that Joe, in the SOC, actually has an action here, but never does it. I’ll work to bridge that gap.”).
Multiple Playbooks per case
Playbooks can be broken down into multiple components. If so, it’s recommended to create a cover page listing the various components and an overview diagram showing how the pieces fit together.
Community Driven Playbooks
Workflows for broadcasting requirements for new Playbooks. All playbooks undergo an audit,testing and move to production flow.
Analytics & Observability
We provide insights on how each Playbook and the tasks have been timelined and used.
Contact
Your message is important to us. We will ensure to get back within 24 hours.
Email Us
contact@flexibleir.com