Playbooks don't replace or restrict analysts; however, they can help them perform more thorough investigations. Creating and using them also serves as an excellent learning tool. I hope this standard and its adoption will help folks along that path. #SOC #DFIR

Analysts derive playbooks through inductive reasoning processes. The process is often as valuable as the result. We needed a way to express those cleanly and effectively, supporting analyst cognition.

Analysts encounter common scenarios (cues) across diverse investigations based on the evidence they encounter and their forecasting of potentially related events. Many of the initial investigative questions analysts will ask in response to these cues can be predicted.

Better yet, the folks at Security Onion have integrated the standard into their platform and released a new guided investigation feature today. Every alert in Security Onion will now have linked investigation playbooks you can work from.