Runbook
Definition
A technical execution document, sometimes used interchangeably with playbook but more precisely refers to the low-level commands and scripts used during a specific phase of response, such as the exact CLI commands to isolate a host. A playbook may reference one or more runbooks.
- Level
- Low-level, phase-specific
- Contents
- Exact commands and scripts
- Relation to playbook
- A playbook may reference several runbooks
Common questions
How is a runbook different from a playbook in incident response?+
A playbook lays out the overall decision flow and phases of response to a given incident type, while a runbook contains the concrete, executable steps for one specific action within that flow, such as the precise CLI commands to isolate a compromised host.
Why keep runbooks separate from the playbook document?+
Runbooks change more often, as tooling and commands are updated, and are typically specific to an environment, so separating them lets a team update technical execution steps without rewriting the higher-level response strategy each time.
Related terms
- Decision Gate
- A checkpoint within a playbook at which the responder must evaluate a condition, such as whether data exfiltration has been confirmed, and...
- Indicators of Compromise (IoCs)
- Artefacts observed on a network or system that suggest an intrusion or malicious activity has occurred, such as unusual outbound connections, known-malicious...
- Playbook
- A documented step-by-step procedure for responding to a specific type of security event. Playbooks standardise analyst behaviour, reduce response time, and ensure...
- SOAR
- Security Orchestration, Automation and Response. A platform that can execute playbook steps automatically, such as blocking an IP address or disabling a...
- Tabletop Exercise
- A structured, discussion-based simulation in which team members walk through a hypothetical incident using the playbook as a guide, without touching live...