defensive-incident-response

What problem does it solve?

Incident response lifecycles can be chaotic; this playbook provides a structured, repeatable approach to identify, contain, and eradicate threats using the PICERL lifecycle, evidence collection order, and KQL queries for rapid investigation.

Core Features & Use Cases

• PICERL phases with concrete actions and decision points
• Containment guidance, evidence ordering, and MITRE ATT&CK mapping
• Per-phase KQL hunt queries and remediation steps
• Use case: contain a compromised host, scope lateral movement, and rotate credentials

Quick Start

Initiate incident response by identifying scope, isolating affected hosts, and executing the PICERL lifecycle with recommended actions.