Lion Cipher Lab
Build an incident-response runbook
- Digital Forensics & IR (DFIR)
- Beginner
- ~60 min
- Free · no account required
Why it matters
The move from doing security tasks to leading them turns on one artifact: a runbook. When an alert fires and the room tenses up, the difference between a calm, effective response and a costly scramble is almost never raw skill -- it is whether someone wrote down, in advance, who is in charge, who talks to whom, what gets contained first, and how evidence is preserved so it still means something later. That written play is a runbook, and being the person who can produce a usable one is a defining technical-lead skill. This lab teaches you to build it on the two frameworks working responders…
What you'll learn
- the NIST incident-response lifecycle
- the SANS PICERL mnemonic
- assigning incident roles (commander, comms, scribe)
- classifying incident severity
- mapping communication and escalation paths
- evidence handling and chain-of-custody basics
- writing a one-page runbook
- testing a runbook with a tabletop exercise
Steps in this lab
- What a runbook is, and why an untested one fails
- The two frameworks: NIST's lifecycle and SANS's PICERL
- Assign the roles before you need them
- Classify severity, and map who gets called
- Handle evidence so it still means something later
- Draft your one-page runbook for a real scenario
- Test it with a fifteen-minute tabletop
- Why the short, rehearsed version wins