Okuzeka
Cybersecurity vocabulary · Incident Response

Playbook

Meaning in cybersecurity, with examples

nounCommon term

In cybersecurity, playbook means: A written, step-by-step guide that tells a security team how to handle a specific type of alert or incident, such as phishing or ransomware.

In Turkish: müdahale kılavuzu, playbook, olay müdahale senaryosu

How it is used

SOC and incident response teams write, follow and update playbooks. When the steps are automated in a SOAR tool, people may also call them runbooks or workflows. Playbooks are tested in tabletop exercises.

Example sentences

  1. Follow the phishing playbook: check the headers, block the sender, then search the other mailboxes.

  2. After the incident, we updated the ransomware playbook with the new contact list.

Common collocations

  • incident response playbook
  • follow the playbook
  • automated playbook
  • runbook
  • incidentAn event that threatens or harms the confidentiality, integrity or availability of systems or data, such as a malware infection or an unauthorised login.
  • SOCSecurity operations centre: the team, and often the room, that monitors an organisation's systems around the clock and responds to security alerts.
  • containmentThe stage of incident response in which the team stops an attack from spreading or causing more damage, for example by isolating infected machines.
  • escalateTo pass an alert, incident or problem to a more senior person or team because it is serious or beyond your own authority or skills.

This word in other fields

The same English word can have a different meaning in another field:

More terms: Incident Response

Practise with graded reading

Reading at the right level is the fastest way to make new words stick. Pick free English books by level: