What is a playbook in incident response?
⚡
Quick Answer
A playbook is a broader action plan coordinating the response to a class of incident (e.g., a security breach or major outage) — roles, communication, decision points, and escalation — often composed of several runbooks.
Detailed Answer
Where a runbook is the how-to for a specific task, a playbook orchestrates the overall response: who commands the incident, how to communicate to stakeholders, when to escalate, and which runbooks to invoke. In security, SOAR platforms automate playbooks. Rehearsing them (game days) is what makes them work under pressure.
💡
Interview Tip
Distinguish playbook (coordinates the whole response) from runbook (one task) and mention rehearsing via game days.
playbookincident-responsesecurity