Playbook Development
Build a tailored, go-to guide for handling an incident
TrustedSec helps organizations document steps that analysts and investigators will perform during the hands-on Incident Response process.
Organizations often respond to the same types of incidents over and over again. From malware to phishing to ransomware, oftentimes the attack scenarios are the same. Because of this, analysts and responders tend to perform the same tasks when responding to these events. However, most organizations find that these tasks are based on ad hoc knowledge, not performed consistently, and not documented. The solution to best protect against these types of issues is to create Incident Response Playbooks.
The creation and utilization of Incident Response Playbooks allows analysts to respond to an incident consistently, ensures that correct procedures are followed, and provides an organization with a roadmap to determine where processes can be automated and enhanced to improve critical response time.
A proven process to excel at a critical moment
With their years of experience, TrustedSec’s Incident Response team is able to provide a unique insight into attacks and assist in creating Incident Response Playbooks. This process includes:
- Determining what common incidents an organization is seeing and reviewing industry research;
- Interviewing appropriate personnel to find the tools used in current procedures or processes; and
- Documenting the methods critical for success prescribed with the organization’s input.
Get real security guidance from real security experts.
Experts across security domains are ready to tackle your security challenges.
Read our blog
Explore the latest cybersecurity topics on the TrustedSec Security Blog
Hardening Intune: The Implementation Guide
Now that we've identified the blind spot, here's how to fix it. In Part 2 of our blog series, we deliver a phase-based implementation guide to hardening…
The Privileged Roles Nobody Talks About
MDM admins can deploy apps, or wipe every device in your fleet. Yet most treat them like standard IT roles. In Part 1 of this blog series, we break down the…
Shai-Hulud Is Back, and This Time It Ate the Whole Ecosystem
Same worm, different wave. In our new blog, Director of Security Intelligence Carlos Perez covers Shai-Hulud, how this supply-chain malware can eat your whole…
Slamming the Door on Quick Assist Tech Support Scams and Abuse
Tech support scams are simple by design—just a trusted tool and a convincing story. We break down Microsoft Windows Quick Assist as an attack vector, detection…
Building a Detection Foundation: Part 5 - Correlation in Practice
From Data Sources to DetectionWe've covered a lot of ground in this series: Windows Security events for logon tracking and process execution; PowerShell…
Building a Detection Foundation: Part 4 - Sysmon
Filling the Gaps Native Logging Can'tAt this point in our series, we have Windows Security events capturing logon sessions and process creation, and…
Building a Detection Foundation: Part 3 - PowerShell and Script Logging
The Second Most Important Data Source You're Probably Not CapturingIn Part 2, we enabled process creation logging with command lines. That's a big…
Building a Detection Foundation: Part 2 - Windows Security Events
The Audit Policies Nobody ConfiguresIn Part 1, we looked at why relying on a single telemetry source is a recipe for blind spots. Now let's get practical.…
Building a Detection Foundation: Part 1 - The Single-Source Problem
If your EDR goes dark, can you still see the attack? In the part one of a five part series, we go through the risks of single-source visibility and why…
Adventures in Primary Group Behavior, Reporting, and Exploitation
Not all AD group membership is created equal. In this blog, we explore how the primaryGroupID attribute can be abused to hide privileges as well as how teams…