Cyber Incident Response Playbook Battle Cards Logo

Cyber Incident Response Playbook Battle Cards

0
Free
Visit Website

A collection of Cyber Incident Response Playbook Battle Cards (PBC) which are recipes for preparing and applying countermeasures against cyber threats and attacks. PBC follow a prescriptive approach to combat various TTP deployed by cyber threat actors, aiding the kinetic activities conducted by humans prior to, during, and after cybersecurity incident response. Inspired by CERT Societe Generale's IRM, these cards are valuable resources for incident response teams. For more information, visit: - CERT Societe Generale's IRM: https://github.com/certsocietegenerale/IRM/ - GuardSight's Cybersecurity Incident Response Plan: https://github.com/guardsight/gsvsoc_cybersecurity-incident-response-plan - Incident Response Playbooks: https://www.incidentresponse.com/playbooks/ - NIST Cybersecurity Framework: https://www.nist.gov/cyberframework - NIST Special Publication 800-184: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-184.pdf - NIST Special Publication 800-61 Rev. 2: https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final - MITRE Cyber Exercise Playbook: https://www.mitre.org/sites/default/files/publications/pr_14-3929-cyber-exercise-playbook.pdf

FEATURES

ALTERNATIVES

A comprehensive auditd configuration for Linux systems following best practices.

An open-source, drag-and-drop security workflow builder with integrated case management for automating security workflows and tackling alert fatigue.

jimi is an orchestration automation tool for multi-team collaboration and automation in IT/Security operations, Development, and CI/CD pipelines.

CBRX is a cloud-based platform that automates incident analysis and reporting for cybersecurity teams.

A mature SIEM environment is critical for successful SOAR implementation.

WALKOFF is an automation framework for integrating capabilities and devices to streamline tasks.

An AI-powered SOC automation platform that performs autonomous alert triage, investigation, and incident response while augmenting human analyst capabilities.

A DFIR Playbook Spec based on YAML for collaborative incident response processes.

PINNED