SecOps Playbooks

This repository contains a baseline SOC investigation flow and modular security operations playbooks designed for repeatable, audit-defensible incident analysis.

Contents

• Baseline SOC Flow
• Playbook routing logic
• Playbooks
  • Phishing Playbooks
  • Identity High Risk sign-ins
  • C2 analysis
  • Ransomware / Malware
  • Application & Data compromise

All diagrams are written in Markdown using Mermaid.

Author

Michael Baker
Cybersecurity Manager

Developed based on real-world SOC operations to support repeatable, audit-defensible security investigations. (Last Updated 12/2025)