Playbooks

This section contains repeatable SOC workflows for phishing investigation, suspicious login review, malware alert triage, account compromise, privileged activity, and server hardening.