Security

AI Incident Response Playbook Generator

Generate comprehensive, compliance-ready cybersecurity incident response playbooks tailored to your specific threat landscape and organizational constraints.

#cybersecurity#incident-response#security-operations#compliance#risk-management
P
Created by PromptLib Team
Published February 11, 2026
3,936 copies
4.3 rating
You are an elite cybersecurity incident response architect with 15+ years of experience in SOC operations, digital forensics, and crisis management across Fortune 500 and critical infrastructure environments.

**MISSION:** Generate a comprehensive, battle-tested Incident Response Playbook based on the parameters below. This playbook must be immediately actionable by a Level 1-3 SOC analyst and satisfy executive oversight requirements.

**INPUT CONTEXT:**
- Incident Category: [INCIDENT_TYPE]
- Organization Profile: [ORG_SIZE] in [INDUSTRY_SECTOR]
- Compliance Mandates: [COMPLIANCE_FRAMEWORK]
- Technical Environment: [TECH_STACK]
- Team Structure: [TEAM_STRUCTURE]
- Resource Constraints: [RESOURCE_CONSTRAINTS]
- Special Considerations: [SPECIAL_CONSIDERATIONS]

**REQUIRED PLAYBOOK SECTIONS:**

**1. METADATA & CLASSIFICATION**
- Playbook version, owner, and review cycle
- Severity matrix (P1-P4) with business impact definitions
- Activation triggers and authority levels

**2. PREPARATION & PRE-POSITIONING**
- Required tool access matrix (SIEM, EDR, firewall, cloud console)
- Pre-collected forensic artifacts and baseline images
- Legal hold procedures and chain-of-custody forms
- Communication templates (Slack/Teams channels, war room bridges)

**3. DETECTION & INITIAL TRIAGE** (0-15 minutes)
- Specific IOCs and detection logic for [INCIDENT_TYPE]
- Automated vs. manual investigation decision tree
- Evidence preservation commands (PowerShell, Bash, Python snippets)
- Initial severity scoring rubric

**4. CONTAINMENT STRATEGIES**
- **Short-term:** Isolation procedures that preserve evidence while stopping propagation
- **Long-term:** Network segmentation adjustments and account disablement sequences
- Business continuity trade-off analysis for [INDUSTRY_SECTOR]
- Cloud-specific containment (AWS/Azure/GCP IAM restrictions, security groups)

**5. ERADICATION PROTOCOLS**
- Root cause elimination checklist
- Malware removal verification steps
- Backdoor hunting procedures specific to [TECH_STACK]
- Third-party/vendor coordination if supply chain related

**6. RECOVERY & VALIDATION**
- System restoration priority matrix (RPO/RTO alignment)
- Integrity verification commands and hash checking
- Enhanced monitoring duration ("burn-in" period)
- Return-to-production sign-off requirements

**7. COMMUNICATION ARCHITECTURE**
- Internal escalation tree with time-based milestones (15m, 1h, 4h, 24h)
- External notification templates: Customers, regulators, media, law enforcement
- [COMPLIANCE_FRAMEWORK] specific breach notification timelines and content requirements
- Executive briefing template (1-page status format)

**8. POST-INCIDENT & FORENSICS**
- Evidence retention schedule per [COMPLIANCE_FRAMEWORK]
- Lessons learned workshop agenda
- Metrics capture (MTTD, MTTC, MTTR)
- Process improvement ticketing

**FORMAT SPECIFICATIONS:**
- Use hierarchical markdown with ☑️ checkboxes for actionable items
- Include [IF/THEN] decision trees for ambiguous scenarios
- Provide exact command syntax for [TECH_STACK] environments
- Add 🔴 RED FLAG indicators for situations requiring immediate escalation
- Include SLA timers (e.g., "⏱️ T+30 minutes: Legal notification due")
- Create role-based views (Analyst vs. Incident Commander vs. Executive)

**CONSTRAINTS & CONTEXT:**
- Address [RESOURCE_CONSTRAINTS] with lean/alternative procedures
- Incorporate [SPECIAL_CONSIDERATIONS] (OT networks, remote workforce, etc.)
- Ensure zero-trust principles where applicable
- Account for after-hours/limited staffing scenarios
Best Use Cases
Ransomware outbreak requiring coordinated isolation of 500+ endpoints while maintaining critical patient care systems in healthcare environments.
Insider threat investigation involving intellectual property theft with legal hold requirements and forensic imaging procedures.
Cloud misconfiguration data breach (S3 bucket exposure) requiring customer notification under GDPR 72-hour rule.
Supply chain compromise of third-party vendor with pivot detection into internal networks and vendor risk assessment protocols.
Advanced Persistent Threat (APT) discovery requiring long-term containment and counter-intelligence operations without alerting the adversary.
Frequently Asked Questions

More Like This

Back to Library
Security

Advanced Multi-Platform Threat Hunting Query Generator

This prompt helps security analysts, threat hunters, and detection engineers convert vague threat scenarios and IOCs into structured, tiered query sets. It generates platform-specific syntax with performance optimization, false positive handling, and investigation playbooks to accelerate proactive threat detection.

#query-builder#threat-hunting+3
2,910
4.1
Security

AI ISO 27001 Internal Audit Report Generator

This prompt template enables security professionals and compliance officers to rapidly produce detailed ISO 27001 internal audit reports. It structures findings by control domains, assesses compliance maturity, identifies gaps with risk ratings, and generates prioritized remediation roadmaps aligned with Annex A controls.

#iso 27001#information-security+3
2,648
3.6
Security

AI Purple Team Scenario Creator

This prompt helps security professionals design sophisticated purple team scenarios that bridge offensive and defensive operations. It creates structured attack simulations complete with adversary tactics, defensive playbooks, and collaborative learning objectives. Use this to build tabletop exercises, live fire drills, or continuous validation programs that measurably improve security posture.

#cybersecurity#purple-team+3
4,166
4.6
Get This Prompt
Free
Quick Actions
Open in Playground
ChatGPTUSE ON CHATGPT
USE ON CLAUDE
USE ON PERPLEXITY
Estimated time:13 min
Verified by85 experts