c2.22 Define incident response playbooks
Decide in advance which undesirable situations warrant action and document the response as playbooks. A documented plan gives consistent, repeatable response even when your most senior responder is unavailable.
Implementation guidance
Plan responses before you need them
The first step in incident response is to enumerate the undesirable situations that can occur and define the action plan for each. For example, when Amazon GuardDuty reports cryptomining or outbound connections to a known command-and-control address from an EC2 instance, the playbook might isolate the instance (a security group that blocks outbound traffic and allows inbound admin access only from the forensics team's IP).
Document as playbooks
Write these scenarios up as playbooks. Documentation gives you consistency and scale: when the most senior responder is on vacation, junior staff can respond the same way by following the plan. The AWS Security Incident Response Guide is a strong starting framework, and the AWS customer playbook framework provides ready-to-adapt samples.
Keep them living
Review and test playbooks periodically (including tabletop exercises) so they stay accurate as your environment and services change.
How to validate
- Have you enumerated the incident scenarios that warrant a defined response?
- Are responses documented as playbooks the whole team can follow?
- Do you test and update the playbooks periodically (for example with tabletop exercises)?
Threats addressed
- Without a predefined plan, response is improvised and slow, giving an adversary more time to act and increasing the chance of inconsistent or incomplete eradication.
AWS services
AWS Security Incident Response 
Amazon GuardDuty