SOC Incident Response Runbook

Overview

This repository contains a collection of SOC analyst incident response playbooks, each designed and executed in a controlled lab environment.
Every playbook demonstrates end-to-end handling of security incidents — from detection and alerting through containment, recovery, and executive reporting.

The goal is to provide practical, hands-on examples of security monitoring and incident response workflows across multiple domains:

• Endpoint Security: SSH brute force, Windows malware execution
• Email Security: Phishing and credential harvesting
• Cloud Security: AWS IAM / CloudTrail / CloudWatch login abuse
• Network / Application Security: DDoS / Apache HTTP flood (UFW blocks, Apache mod_evasive rate limiting, Splunk dashboards)

All screenshots were generated in lab environments I configured (Splunk, Windows Defender, AWS CloudTrail/CloudWatch, Apache web server).
Each playbook includes metrics (MTTD/MTTR), SOC tickets, knowledge base entries, and leadership-ready executive summaries.

---

Table of Contents

Playbook	Markdown	PDF
SSH Brute Force	View	Download
Phishing	View	Download
Malware	View	Download
Cloud / AWS Security	View	Download
DDoS / Apache HTTP Flood	View	Download

---

Key Features

• Detection & Alerting: SIEM searches, log analysis, dashboards, and automated alerts
• Containment & Recovery: UFW rules, IAM access restriction, endpoint isolation, MFA enforcement
• SOC Process Layers:
  • Tier-1 analyst decision flowcharts
  • User communication templates for awareness and response
  • Metrics tracking (MTTD/MTTR, user reporting rate, impacted users)
  • SOC tickets with timelines, indicators, impact, and actions
  • Knowledge base entries for training and repeatability
  • Executive summaries for leadership reporting

---

Why This Project Matters

• Demonstrates real SOC workflows across multiple threat vectors
• Shows experience with Splunk, AWS CloudTrail/CloudWatch, Windows Defender, IAM security controls, and phishing analysis
• Organized in a professional, audit-ready format aligned with NIST 800-61 and SOC best practices
• Designed to serve as both a portfolio project for recruiters/hiring managers and a training resource for SOC analysts

---

Repository Structure

soc-runbook/
├── playbooks/ # Markdown playbooks (with screenshots inline)
│ ├── ssh_bruteforce.md
│ ├── phishing.md
│ ├── malware.md
│ ├── cloud.md
│ └── ddos.md
├── screenshots/ # Supporting images for playbooks
│ ├── ssh_bruteforce/
│ ├── phishing/
│ ├── malware/
│ ├── cloud/
│ └── ddos/
├── pdfs/ # Clean PDF exports (no screenshots)
│ ├── ssh_bruteforce_noscreens.pdf
│ ├── phishing_noscreens.pdf
│ ├── malware_noscreens.pdf
│ ├── cloud_noscreens.pdf
│ └── ddos_noscreens.pdf
└── README.md # Main repository overview

---

References

• NIST 800-61: Computer Security Incident Handling Guide
• Splunk Documentation
• AWS IAM Security Best Practices
• Microsoft Security Documentation
• CISA Phishing Guidance
• Apache mod_evasive Documentation