From Threat to Runbook

Why this matters

Every threat your team identifies should produce an incident runbook — a one-pager that says 'when X is detected, do Y'. The runbook is for the 3am pager moment, not the strategy review. Good runbooks have: definition of the trigger, decision tree (when to escalate), commands to run, communications template, and a 'don't do this' list.

Demo

Runbook shape: trigger (alert ID + signal), severity classification (3 questions: production impact, data sensitivity, blast radius), first 5 commands (collect evidence, contain, alert team), escalation rules, comms template (status page, customer email).

Try it yourself

1. Pick one threat from your model. Write its runbook in one page.
2. Test on a teammate who hasn't seen it. Can they execute it during a simulated alert?
3. Iterate. Store in a wiki the on-call can grep at 3am.

References

• Google SRE — Postmortems and Runbooks
• PagerDuty — Incident Response