Defender playbook

What the room does when an opponent lands, in the order it has to happen, with the time each play should be finished by. Pick a run below to see how yours went. Open the attacker console.

Training room — practice every step with a coach score. · Your dashboard — labs finished, scores and the next step. · Breach response plan — the same steps with real clocks, owners, tools and who to call. · SOAR console — one playbook per technique on this run, with owners, clocks and approval gates.

The plays, in order

01
Watch the wire against the baseline
detect
by 03:00
A breach shows up as traffic the estate has never carried before.
Set off by: The run starts; the baseline recording is already in place.
1. Open the traffic baseline dashboard and check the drift score.
2. Look for ports a machine has never spoken and protocols it has never used.
3. Note which machines went loud or went silent.
On the wire: TCP, LDAP · ports 445, 3389, 22, 389 — Half-open probes across the range and a wide directory search.
How this is done for real
Detection is a comparison, not a feeling: today's traffic against what this estate normally carries, with the exceptions written down.
- Network
  Flow collector or NDR console
  Chart bytes and connection counts per host over 24 hours; sort by hosts talking to destinations first seen in the last 7 days.
  First-seen destinations catch command and control long before signatures do.
- Any platform
  SIEM
  Run a scheduled search for ports and protocols outside each asset group's approved list, and for hosts that stopped reporting.
  A missing heartbeat is the one alert an intruder cannot delete.
- Windows
  Endpoint console
  Check agent health coverage: machines with the agent stopped, out of date, or in bypass.
Keep as evidence
The baseline window used, with start and end times.
The saved query, so the same comparison can be re-run later.
Where teams get it wrong
Baselining while an intrusion is already running, which makes the intrusion normal.
Alerting on volume alone — rhythm and first-seen destinations beat size.
Done when: You can name what this machine normally does and what it did instead.
02
Confirm it on the packet timeline
verify
by 04:00
Drift can be a busy afternoon; the timeline names the account.
Set off by: Drift is notable or worse, or a flagged frame appears.
1. Filter the packet timeline to flagged frames.
2. Read the account on each frame and the machine it came from.
3. Write down the first frame's clock time — that is the breach time.
On the wire: KRB5, SMB2 · ports 88, 445 — Ticket requests with weak encryption, share reads by an account that has no business there.
How this is done for real
Before anyone is woken up, the signal is turned into a sequence: who, on what, to where, in what order, with timestamps you would put in front of a lawyer.
- Any platform
  Packet capture or full-fidelity flow
  Pull the conversation by five-tuple around the alert time and read it end to end: tshark -r capture.pcap -Y "ip.addr==10.20.0.10 && frame.time >= ..."
- Windows
  Event logs on the host and the collector
  Correlate 4624/4625 logons, 4688 process creation and 7045 service installs against the packet timestamps.
  Always work from the forwarded copy: the local log is the first thing altered.
- Linux
  Host
  journalctl --since with auditd execve records and /var/log/auth.log, plus `last` and `ss -tunap` for live sessions.
Keep as evidence
One timeline in UTC with source, destination, account and action per row.
Hashes of any capture or log export taken.
Where teams get it wrong
Mixing local clock and UTC, which reorders the story.
Deciding it is a false positive because one log is missing — absence is a finding.
Done when: You can state the first malicious action and the evidence for it.
03
Isolate the machine the attacker holds
contain
by 07:00
console: isolate
Every minute it stays on the network is another machine it can reach.
Set off by: A successful attacker move is confirmed on a known machine.
1. Identify the foothold machine from the timeline.
2. Press Isolate on the attacker console for that machine.
3. Check the wire goes quiet for that source address.
On the wire: DRSUAPI, RDP, HTTPS · ports 49667, 3389, 6443 — Replication pulls, remote desktop requests and control plane calls stop after isolation.
How this is done for real
Containment in real estates means the machine keeps running for evidence but can only talk to you — network quarantine, not shutdown.
- Windows
  EDR console
  Use the product's network containment action, which leaves the agent channel open so you can still collect.
  Containment through the agent survives a reboot; a firewall rule on the host does not.
- Network
  Switch or NAC
  Move the port to a quarantine VLAN with an ACL permitting only the responder jump host and the agent's cloud endpoint.
  Use this when the machine has no agent — appliances, printers, plant controllers.
- Cloud
  Cloud console
  Attach a deny-all security group and detach the instance from its load balancer and auto-scaling group before you touch it.
  Skip the detach and the platform will replace the instance and destroy your evidence.
Keep as evidence
Memory capture before the network drops, where policy allows it.
Time the containment took effect, and by whom.
Where teams get it wrong
Powering the machine off, which loses memory, keys and running processes.
Isolating only one machine when the same account is live on three.
Quarantining with a rule the attacker's own admin rights can remove.
Done when: Traffic from that machine stops in the capture and its retry shows as a dropped attempt.
04
Block the account and the route
contain
by 09:00
console: block
Isolating one machine does nothing if the credentials still work elsewhere.
Set off by: The account behind the frames is known.
1. Disable the account named on the flagged frames.
2. Press Block on the attacker console.
3. Roll anything the attacker may hold — service passwords, issued certificates.
On the wire: KRB5, HTTPS · ports 88, 443 — Ticket requests for the blocked account start being refused on the wire.
How this is done for real
Blocking is applied where the attacker cannot reach the control: at the edge and in identity, not on the compromised host.
- Network
  Perimeter firewall and secure web gateway
  Block the destination address and the domain, and sinkhole the name on the internal resolver so fallback channels also die.
  A web block alone leaves DNS tunnelling wide open.
- Any platform
  Identity provider
  Disable the account, revoke refresh tokens and active sessions, then rotate its secrets.
  Disabling without revoking leaves an existing token valid until it expires.
- Cloud
  Cloud identity
  Revoke the access key, apply a deny-all policy to the principal, and check for keys the intruder created.
Keep as evidence
The exact indicators blocked, with the time and the change ticket.
A list of everywhere the blocked credential was used in the last 30 days.
Where teams get it wrong
Blocking one address when the operator has a dozen.
Resetting a password but not the tokens already issued from it.
Tipping the attacker off before the scope is understood.
Done when: New connection attempts to the operator are refused at the edge and the account cannot authenticate.
05
Preserve the evidence before you clean up
eradicate
by 12:00
The capture is the only record of what actually happened.
Set off by: Containment is recorded.
1. Replay the attacker's conversations in the traffic inspector.
2. Export the breach timeline for the debrief.
3. Note every machine the attacker touched, not just the first one.
On the wire: TLS, HTTPS, SMB2 · ports 443, 445 — Large outbound uploads and staged archives — the size of the loss.
How this is done for real
Everything that will be argued about later is collected now, with hashes, because it gets overwritten within hours.
- Windows
  Responder jump host
  Take a triage collection (memory, MFT, registry hives, event logs, prefetch, scheduled tasks) with your standard collector, then hash the package.
- Linux
  Host
  Capture memory, then /var/log, auditd, bash history, systemd units and crontabs; copy off, never work on the original.
- Cloud
  Cloud console
  Snapshot the disk, export the audit and storage access logs for the window, and lock the retention on both.
Keep as evidence
A chain-of-custody note: who collected what, when, from where, and the hash.
Retention extended on anything that would otherwise roll off.
Where teams get it wrong
Rebuilding first and collecting after — the fastest way to lose the case.
Storing the collection on the estate the intruder is still in.
Done when: Someone else could reproduce your findings from the package alone.
06
Close the way in
eradicate
by 14:00
Containment without a fix just moves the next run a few minutes later.
Set off by: The technique is identified from the playbook lab.
1. Harden the thing that let the move work — template, share permission, cluster role.
2. Re-run the attacker move and confirm it is refused.
3. Record the fix against the run.
On the wire: HTTPS, SMB2, LDAP · ports 443, 445, 389, 6443 — The same request appears again and comes back refused.
How this is done for real
The way in is closed and every foothold is removed; if you cannot list how they got in, you have not finished this play.
- Any platform
  Change management
  Patch or remove the exploited service, close the management interface to the internet, and re-test the original request to prove it now fails.
- Windows
  Host and directory
  Remove services, scheduled tasks, run keys and WMI subscriptions the intruder added; reset krbtgt twice if directory replication was abused.
  One krbtgt reset leaves forged tickets valid; two kills them.
- Any platform
  Identity
  Rotate every credential the compromised machine could read, including service accounts and stored tokens.
Keep as evidence
A before-and-after of the exploited request or logon path.
The list of persistence removed, per machine.
Where teams get it wrong
Rebuilding the machine but leaving the credentials it gave up in place.
Closing one route while a second foothold sits on a machine nobody looked at.
Done when: The original entry attempt fails and no persistence remains on any affected machine.
07
Restore the baseline
recover
by 15:00
console: restore
The estate is only recovered when its traffic looks like itself again.
Set off by: The way in is closed and the machine is clean.
1. Bring the isolated machine back.
2. Press Restore on the attacker console.
3. Confirm drift falls back to clean on the baseline dashboard.
On the wire: SMB2, NFS · ports 445, 2049 — Normal share and backup traffic returns; nothing new on sensitive ports.
How this is done for real
Service comes back from a known-good state and stays watched, and the estate is measured against the baseline again to prove it really is back.
- Any platform
  Backup or image pipeline
  Rebuild from an image or restore from a recovery point taken before the first malicious action, then patch before reconnecting.
  Restoring to a point after the foothold restores the foothold.
- Network
  NAC or switch
  Return the port to its production VLAN only once the machine is patched, re-enrolled and reporting.
- Any platform
  Monitoring
  Re-run the baseline comparison and keep an enhanced watch on the affected machines for at least two weeks.
Keep as evidence
The recovery point used and why it is trusted.
The post-restore baseline comparison showing drift back to normal.
Where teams get it wrong
Bringing the machine back before patching, so it is reinfected in minutes.
Declaring recovery from uptime rather than from a comparison.
Done when: The estate's drift is back within its normal band and the service is doing its usual work.
08
Write it up
report
The run is worth nothing to the next team if nobody can read it.
Set off by: The run is recovered or the clock has run out.
1. State the breach time, the containment time and the recovery time.
2. Name the technique and link the lab that teaches it.
3. Say what would have caught it sooner.
Nothing on the wire — this one is written down.
How this is done for real
The write-up is the product: what happened, when you knew, what you did, what it cost, and the two or three changes that stop the next one.
- Any platform
  Case record
  Write the timeline in UTC, the scope of data and accounts affected, and the detection and response times against your targets.
- Any platform
  Legal and compliance
  Check the notification clock for your jurisdiction and sector, and record the decision either way with a reason.
  Several regimes count from the moment of awareness, not from the end of the investigation.
- Any platform
  Detection engineering
  Turn each missed signal into a rule, and each rule into a test that runs on a schedule.
Keep as evidence
Final timeline, indicator list and the actions taken with their times.
Named owners and dates for every follow-up change.
Where teams get it wrong
A write-up that names the malware but not the control that failed.
Follow-up actions with no owner, which never happen.
Done when: Someone who was not there can read the case and know what to change.

Course: running a breach response

0 of 8 passed

Eight steps, each with a practice run you can take as often as you like.

01
Notice it
detect
Know what this estate normally carries, so the thing that is not normal stands out on its own.
In a live run: A breach shows up as traffic the estate has never carried before.
Done for real: Detection is a comparison, not a feeling: today's traffic against what this estate normally carries, with the exceptions written down.
A finance workstation has been sending 4 MB an hour to a hosting provider, every hour, since Tuesday. Everything is HTTPS on port 443. Nothing has alerted.
What makes this worth opening, when the traffic is allowed and the volume is small?
Practice run: work this play as a live breach step
02
Confirm it
verify
Turn a signal into a sequence — who, on what, to where, in what order — before anyone is woken up.
In a live run: Drift can be a busy afternoon; the timeline names the account.
Done for real: Before anyone is woken up, the signal is turned into a sequence: who, on what, to where, in what order, with timestamps you would put in front of a lawyer.
The beacon above is real. Your manager is asking whether to pull the machine off the network right now.
What has to be true before you answer that question?
Practice run: work this play as a live breach step
03
Cut the machine off
contain
Take the host out of reach without losing the evidence on it.
In a live run: Every minute it stays on the network is another machine it can reach.
Done for real: Containment in real estates means the machine keeps running for evidence but can only talk to you — network quarantine, not shutdown.
You are isolating the finance workstation. It is running and the operator is active on it.
Which action keeps both the containment and the case?
Practice run: work this play as a live breach step
04
Close the route
contain
Deny the infrastructure, not just the one machine that used it.
In a live run: Isolating one machine does nothing if the credentials still work elsewhere.
Done for real: Blocking is applied where the attacker cannot reach the control: at the edge and in identity, not on the compromised host.
The workstation is isolated. The command destination is a single address at a hosting provider, resolved from a domain that changes every few days.
What do you block?
Practice run: work this play as a live breach step
05
Keep the evidence
eradicate
Take the copies that stop existing the moment you start cleaning up.
In a live run: The capture is the only record of what actually happened.
Done for real: Everything that will be argued about later is collected now, with hashes, because it gets overwritten within hours.
Cleanup starts in ten minutes. Logs on this host roll every 24 hours.
Which of these is the one that cannot be recovered later?
Practice run: work this play as a live breach step
06
Remove the access
eradicate
Take away every way back in, not only the one you found first.
In a live run: Containment without a fix just moves the next run a few minutes later.
Done for real: The way in is closed and every foothold is removed; if you cannot list how they got in, you have not finished this play.
You removed a service the operator installed and deleted their scheduled task. The account they used is a service account with a password last changed in 2021.
What is still outstanding?
Practice run: work this play as a live breach step
07
Put it back
recover
Return service from a point you can prove is clean, and check it before the business uses it.
In a live run: The estate is only recovered when its traffic looks like itself again.
Done for real: Service comes back from a known-good state and stays watched, and the estate is measured against the baseline again to prove it really is back.
The file server has to be back by morning. Your most recent recovery point is from four hours ago — two hours after the first confirmed operator activity.
Which recovery point do you use?
Practice run: work this play as a live breach step
08
Write it down
report
Leave a record the next responder, the auditor and the business can all use.
In a live run: The run is worth nothing to the next team if nobody can read it.
Done for real: The write-up is the product: what happened, when you knew, what you did, what it cost, and the two or three changes that stop the next one.
The incident is closed. You are writing it up the next morning.
What makes the write-up worth the hour it takes?
Practice run: work this play as a live breach step

Full run

A workstation is beaconing out every hour. It is confirmed, the operator is still active, and nothing has been touched yet.

Put the response in the order it has to run.

The plays, in order

Watch the wire against the baseline

Confirm it on the packet timeline

Isolate the machine the attacker holds

Block the account and the route

Preserve the evidence before you clean up

Close the way in

Restore the baseline

Write it up

Course: running a breach response

Notice it

Confirm it

Cut the machine off

Close the route

Keep the evidence

Remove the access

Put it back

Write it down

Full run

How this run went