This repository includes a mapping table and a reference process that allows converting between STIX 2.1 Course of Action objects that make use of the Security Playbook extension and MISP Security Playbook objects.

These playbooks serve as drafts and starting points for initial triage. They are not intended to be final, out-of-the-box solutions but should be adapted to fit the specific practices, procedures, and workflows of the Security Operations Center (SOC) using them.

A base schema for capturing workflow execution status data - SOAR

This is the workbench for designing and updating the "security-playbook" object template for the MISP project - https://github.com/MISP/misp-objects/blob/main/objects/security-playbook/definition.json

Incident response playbooks and templates for real-world security scenarios

An interactive web application that generates comprehensive security playbooks for mitigating the OWASP Top 10 vulnerabilities specific to Large Language Model (LLM) applications. The application consists of a Flask backend that leverages the OpenAI API to generate detailed playbooks, paired with a simple HTML/JavaScript frontend.

SecOps is a living repository for security operations workflows, baseline investigation logic, and modular SOC playbooks. It documents repeatable, audit-defensible approaches to alert triage, threat analysis, and response decision-making, and also serves as a central location for KQL queries, detection logic, and operational security research.