Incident Response Runbooks

Playbooks for the five incident classes we plan for. Each follows the same shape — Identification → Containment → Eradication → Recovery → Post-Incident — so an on-call engineer can jump straight to the matching scenario under pressure.

Contents

Runbook	Use it for
Account Compromise	Suspicious logins, PIM/Defender for Identity alerts, reported credential compromise.
Data Leak / Exfiltration	DLP alerts, abnormal egress, exposed storage URLs, GitHub secret-scanning hits.
Distributed Denial of Service (DDoS)	WAF / Azure DDoS Protection alerts, volumetric or application-layer attacks.
Ransomware & Malware	Defender for Servers alerts, mass file modification, encrypted/inaccessible drives.
Vendor / Supply-Chain Breach	Third-party vendor breach disclosures (e.g., GitHub, CI provider, IdP).

When to use

Pick the runbook matching the trigger you're seeing and work it top to bottom — do not skip Identification, since misclassifying the incident type changes the correct containment action. If a single event spans multiple classes (e.g., a vendor breach that leads to account compromise), run both, starting with whichever has the larger blast radius.

See also: Disaster Recovery for region/service-loss scenarios that aren't attacker-driven, and docs/context/00-asset-glossary.md for code → name lookups.