A STANDARD FOR HUMAN-CENTERED INVESTIGATION PLAYBOOKS

Summary from the TLDR InfoSec newsletter

The Human-Centered Playbook standard is a structured format for documenting investigation workflows through questions that guide analysts during the investigation. Playbooks are triggered by cues such as an attack or a suspicious artifact and progress in a series of questions that include context, log sources, and queries for the analyst. Security Onion has adopted this standard. Sample playbooks are available on the platform.