<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: building-soc-playbooks
description: >-
  Design, document, and maintain SOC playbooks for common alert types including
  phishing, malware, lateral movement, data exfiltration, and insider threat.
  Covers structured response procedures, decision trees, escalation criteria,
  enrichment steps, and playbook-as-code patterns for SOAR integration.
domain: cybersecurity
subdomain: soc-operations
tags:
  - playbook
  - soc
  - incident-response
  - soar
  - runbook
  - triage
  - escalation
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: []
---

# Building SOC Playbooks

## Overview

SOC playbooks standardize analyst response to recurring alert types, reducing
MTTR and ensuring consistent investigation quality across shifts. Effective
playbooks combine decision trees, enrichment steps, containment actions, and
escalation criteria into repeatable workflows that can be executed manually
or automated through SOAR platforms.

## Prerequisites

| Requirement | Purpose |
|---|---|
| SIEM platform (Splunk/Elastic/Sentinel) | Alert source and investigation |
| SOAR platform (XSOAR, Phantom, Tines) | Playbook automation |
| Threat intel feeds | IOC enrichment during triage |
| Case management system | Incident tracking |

## Key Concepts

### Playbook Structure

```yaml
playbook:
  name: Phishing Response
  id: PB-SOC-001
  version: "2.1"
  severity: medium
  sla_minutes: 30
  owner: soc-tier1

  trigger:
    source: siem
    alert_type: phishing_detected
    conditions:
      - field: alert.category
        operator: equals
        value: phishing

  triage:
    - step: extract_iocs
      description: Parse email headers, URLs, attachments
      automated: true
      tool: email_parser

    - step: check_sender_reputation
      description: Query sender domain against threat intel
      automated: true
      tools: [virustotal, abuseipdb, urlhaus]

    - step: detonate_attachments
      description: Submit attachments to sandbox
      automated: true
      tool: anyrun
      timeout_seconds: 300

  decision:
    if_malicious:
      - quarantine_email
      - block_sender_domain
      - disable_user_if_clicked
      - escalate_to_tier2
    if_benign:
      - close_alert
      - update_allowlist
    if_uncertain:
      - escalate_to_tier2
      - add_context_notes

  escalation:
    criteria:
      - executive_targeted
      - credential_harvesting_confirmed
      - more_than_10_recipients
    target: soc-tier2
    sla_minutes: 15
```

### Decision Tree Pattern

```
Alert Received
├── Is alert a known FP? → Close with tuning note
├── Extract IOCs
│   ├── IP/Domain → TI lookup (VT, AbuseIPDB)
│   ├── File hash → Sandbox + VT
│   └── URL → URLhaus + screenshot
├── IOC malicious?
│   ├── YES → Containment actions
│   │   ├── Block IOC at perimeter
│   │   ├── Isolate affected host (if endpoint compromised)
│   │   ├── Reset credentials (if harvested)
│   │   └── Escalate to IR team
│   └── NO → Check behavioral indicators
│       ├── Suspicious behavior? → Escalate to T2
│       └── Clean → Close alert
└── Document findings in case
```

### Enrichment Queries

**Splunk — Related alerts for same user:**
```spl
index=notable user="$affected_user$"
| where _time > relative_time(now(), "-24h")
| stats count by search_name, urgency
| sort -count
```

**Elastic — IOC correlation:**
```
threat.indicator.ip:("$ioc_ip$") OR
threat.indicator.domain:("$ioc_domain$")
| stats count by event.dataset, source.ip
```

**Sentinel KQL — User activity timeline:**
```kql
union SigninLogs, SecurityEvent, OfficeActivity
| where UserPrincipalName == "$user$"
| where TimeGenerated > ago(24h)
| project TimeGenerated, OperationName, ResultType, IPAddress
| sort by TimeGenerated asc
```

### SOAR-Ready Playbook Code

```python
# Tines / XSOAR style action
def enrich_ioc(ioc: str, ioc_type: str) -> dict:
    """Enrich IOC with multiple threat intel sources."""
    results = {}
    if ioc_type == "ip":
        results["virustotal"] = vt_lookup_ip(ioc)
        results["abuseipdb"] = abuseipdb_check(ioc)
        results["greynoise"] = greynoise_query(ioc)
    elif ioc_type == "domain":
        results["virustotal"] = vt_lookup_domain(ioc)
        results["urlhaus"] = urlhaus_check(ioc)
    elif ioc_type == "hash":
        results["virustotal"] = vt_lookup_hash(ioc)
        results["malwarebazaar"] = bazaar_query(ioc)
    return {
        "ioc": ioc,
        "type": ioc_type,
        "enrichment": results,
        "verdict": calculate_verdict(results),
    }
```

## Workflow

1. **Identify** — Catalog top 10 alert types by volume from SIEM
2. **Design** — Build decision tree for each alert type
3. **Document** — Write structured YAML playbook with SLAs
4. **Automate** — Implement enrichment and containment in SOAR
5. **Train** — Walk analysts through each playbook with examples
6. **Measure** — Track MTTR per playbook, identify bottlenecks
7. **Iterate** — Update playbooks quarterly from lessons learned

## Verification

| Check | Method |
|---|---|
| Playbook covers top alert types | Cross-reference SIEM alert volume |
| SLAs defined per severity | Review playbook metadata |
| Enrichment steps automated | SOAR workflow test execution |
| Escalation criteria clear | Analyst walkthrough |
| Playbook versioned in Git | Repository check |
