<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
---
name: building-incident-runbook-library
description: >-
  Create, manage, and maintain a structured library of incident response
  runbooks covering common incident types with step-by-step procedures,
  escalation paths, and automated verification checks.
domain: cybersecurity
subdomain: incident-management
tags:
  - runbook
  - playbook
  - procedures
  - documentation
  - response-library
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["TA0040", "TA0005"]
  nist-csf: ["RS.RP-1", "RS.CO-1", "PR.IP-9"]
  frameworks: ["NIST SP 800-61", "ITIL Incident Management"]
---

# Building Incident Runbook Library

## Overview

A runbook library provides standardized, tested response procedures for
every known incident type. Well-maintained runbooks reduce MTTR by
eliminating decision paralysis during high-stress incidents and ensure
consistent response quality regardless of which responder is on call.

## Prerequisites

| Requirement | Purpose |
|---|---|
| Incident taxonomy | Classification scheme for incident types |
| Response team RACI | Role assignments for each procedure |
| Tool access documentation | Credentials and access for response tools |
| Version control system | Git repository for runbook management |

## Key Concepts

### Runbook Structure

```
RUNBOOK: {INCIDENT-TYPE}-response
├── METADATA
│   ├── Version, last tested, owner
│   ├── Severity mapping
│   └── Estimated resolution time
├── TRIAGE (0–15 min)
│   ├── Initial assessment checklist
│   ├── Severity determination criteria
│   └── Escalation triggers
├── CONTAINMENT
│   ├── Immediate containment actions
│   ├── Evidence preservation steps
│   └── Communication templates
├── ERADICATION
│   ├── Threat removal procedures
│   ├── Patch/fix deployment steps
│   └── Verification commands
├── RECOVERY
│   ├── Service restoration sequence
│   ├── Validation checks
│   └── Monitoring uplift period
└── POST-INCIDENT
    ├── RCA trigger criteria
    ├── Documentation requirements
    └── Detection rule updates
```

### Runbook Categories

| Category | Examples | Typical Severity |
|----------|---------|-----------------|
| Malware | Ransomware, trojan, cryptominer | S1–S2 |
| Phishing | Credential harvest, BEC, spear phish | S2–S3 |
| Data Breach | Exfiltration, exposure, loss | S1–S2 |
| DDoS | Volumetric, application-layer | S2–S3 |
| Insider Threat | Data theft, sabotage, privilege abuse | S1–S3 |
| Account Compromise | Credential stuffing, session hijack | S2–S3 |

### Maturity Levels

| Level | Description |
|-------|------------|
| L1 Draft | Initial procedure documented |
| L2 Reviewed | Peer-reviewed by IR team |
| L3 Tested | Validated in tabletop exercise |
| L4 Automated | Steps integrated with SOAR |

## Workflow

1. Inventory all incident types from historical data
2. Prioritize runbook creation by frequency and severity
3. Draft runbooks following the standard template
4. Peer review with subject matter experts
5. Validate through tabletop exercises
6. Integrate automated steps with SOAR platform
7. Schedule quarterly review and update cycle

```bash
# Create a new runbook from template
node agent.js create --type ransomware --severity S1 \
  --owner "ir-team-lead"

# Validate runbook completeness
node agent.js validate --runbook ransomware-response

# List all runbooks with status
node agent.js list-runbooks --format table
```

## Verification

- [ ] Every S1/S2 incident type has a published runbook
- [ ] All runbooks reviewed within last 90 days
- [ ] Tabletop exercise completed for each critical runbook
- [ ] Runbooks accessible during network outage (offline copy)
- [ ] Escalation contacts verified and current

## References

- NIST SP 800-61 Rev. 2 — Computer Security Incident Handling Guide
- MITRE ATT&CK Framework — https://attack.mitre.org/
- NIST SP 800-61
