Phantom Community Playbooks

ThreatHunter-Playbook

A community-driven, open-source project to share detection logic, adversary tradecraft and resources to make detection development more efficient.

IRM

Incident Response Methodologies 2022

AWS Incident Response Runbook Samples

This project provides customizable AWS incident response runbook samples designed to help organizations improve their security incident handling. The templates follow NIST guidelines and cover common scenarios faced by AWS customers, offering a structured approach to evidence gathering, containment, eradication, recovery, and post-incident activities. ## Key Features - **DoS or DDoS Attack Runbook** — Step-by-step guide for responding to denial-of-service incidents on AWS infrastructure. - **Credential Leakage Runbook** — Procedures for handling compromised AWS credentials and access keys. - **Unintended S3 Bucket Access Runbook** — Response plan for unauthorized access to Amazon S3 buckets. - **NIST-Aligned Framework** — Follows the NIST Computer Security Incident Handling Guide (SP 800-61 Revision 2). - **Customizable Templates** — Designed to be adapted to specific organizational risks, tools, and workflows. ## Philosophy These runbooks are provided as-is to empower AWS customers with practical, adaptable incident response templates that can be tested and integrated into their security operations.

Counteractive Playbooks

A concise, directive, specific, flexible, and free incident response plan template