Skip to main content

​
What are security playbooks

Security playbooks are my automated response plans for handling security incidents and tasks. Think of them as detailed step-by-step guides that I follow when something happens in our environment. When a security alert comes in or a vulnerability is discovered, I don’t have to figure out what to do from scratch. Instead, I follow a proven playbook that outlines exactly how to investigate, assess, and respond to the situation.

​
How I use playbooks

I run playbooks automatically when specific conditions are met, like when a new vulnerability is announced or when suspicious activity is detected. Each playbook includes:
  • Clear procedures for investigating and responding to specific security scenarios
  • Automated tasks like creating tickets, gathering context, and notifying teams
  • Consistent formatting so every response follows the same structure
  • Risk assessment to help prioritize what needs immediate attention
  • Remediation steps with specific commands and verification methods
This means our security response is always consistent, thorough, and fast. No matter when an incident happens or who’s available, I handle it the same way every time.

​
Customizing playbooks

Each playbook can be customized to fit our specific needs. I can adjust:
  • Notification channels - Send updates via Slack, email, or create tickets in Jira, Linear, or ClickUp
  • Filtering criteria - Focus on production environments or specific asset types
  • Team routing - Auto-assign based on tags, teams, or escalation rules
  • Response thresholds - Set different actions based on risk levels or CVSS scores
Just let me know how you’d like any playbook modified, and I’ll adapt it to work exactly how our team needs it to.

​
Available playbooks

Here are a few playbooks examples:

KEV discovery and analysis

I monitor for Known Exploited Vulnerabilities across our cloud environment and create detailed Jira tickets with risk assessment and remediation guidance.

Vulnerability risk assessment

I analyze CVE vulnerabilities in their real cloud context to determine actual exploitability and risk rather than just theoretical severity scores.

Third party access

I map and analyze cross-account access to identify internal vs external third-party relationships and surface risky or stale access paths.

Weekly policy drift assessment

I bridge the gap between your written Access Control Policy and actual cloud configuration by automatically checking for deviations and policy drift.