A runbook is simply a step-by-step guide that explains exactly what to do if a certain type of security event happens. It helps both our SOC (Security Operations Centre) team and you know what actions to take, so that incidents are handled quickly and consistently. They make the response process clear, so you don’t need to be a security expert to follow them.
How detection rules fit in
Before a runbook is used, a detection rule is what alerts us that something unusual or suspicious has happened. Detection rules are automated checks inside the SIEM that look for patterns or activity that could mean a threat – for example, multiple failed logins in a short period, or unexpected data transfers. When a detection rule is triggered, it creates a security event. That’s when the runbook comes into play, telling everyone what to do next.
So, in short, the process is typically as shown below.
A Detection rule spots suspicious activity
A Security Event is created and sent to the SOC
The Runbook provides the agreed-upon steps to handle it
Why we use runbooks
Runbooks are written with as little technical jargon as possible, so anyone involved in the process can follow them. They are based on the SANS 6 Steps of Incident Response, which is a widely used, globally recognised approach for dealing with security incidents.
The SANS 6 steps (Simplified)
Preparation – Make sure everyone is ready and knows their role. Have the right tools and information available.
Identification – Confirm that an incident has happened. This is when the SOC team recognises a threat.
Containment – Stop the problem from spreading. For example, disconnecting an infected computer from the network.
Eradication – Remove the threat completely from your systems.
Recovery – Get systems and operations back to normal as quickly as possible.
Lessons Learned – Review what happened, what worked well, and what could be improved for next time.
Who does what
SOC team – Focuses on preparation and early identification of threats, using detection rules and alerts to spot issues quickly.
Client – Usually carries out containment, eradication, and recovery steps, with advice from the SOC.
Both teams – Share lessons learned to make the process smoother in future.
Key Takeaway
Detection rules find the problem, runbooks explain how to fix it, and teamwork between your organisation and the SOC ensures incidents are resolved faster and more effectively.
And that's it! You now understand the role of runbooks within SIEM. 🎉