Your First-Ever Security Playbook

January 26, 2026

Your First-Ever Security Playbook

If you’ve never used a playbook before, this one is intentionally simple.

Its job is not to make you fast.
Its job is to make you calm, consistent, and correct.

You will improve it over time. That’s expected.

Playbook 001: Unusual Network Activity Detected

Purpose

To guide your response when the monitoring system reports network behavior that doesn’t look normal.

This is one of the most common starting points for security investigations.

Trigger (Why You’re Here)

You open this playbook when any one of the following happens:

Your SIEM raises an alert about unexpected traffic
You see repeated firewall denies from the same source
A system is communicating with networks it normally doesn’t
East-west traffic appears where none existed before

If you’re unsure whether the alert matters, that’s normal.
This playbook helps you figure that out.

Context (Understand Before Acting)

Before touching anything, answer these questions in writing:

What system triggered the alert?
(Example: firewall, SIEM, endpoint agent)
What network zone or VLAN is involved?
(User network, server network, management network, lab segment)
What type of traffic is it?
(SMB, RDP, HTTP, DNS, unknown)
Is this traffic new, rare, or just noisy?

If you can’t answer these yet, that’s okay — the next step helps.

Actions (Step-by-Step Response)

Follow these in order. Don’t skip ahead.

Step 1: Confirm the Alert Is Real

Open the SIEM or logging system
Look for multiple related events, not just one
Check timestamps and frequency

If the alert only happened once and never again, note it — don’t ignore it.

Step 2: Identify the Source and Destination

Write down:

Source IP or system name
Destination IP or system name
Network segment for each

This tells you who is talking to whom.

Step 3: Check Expected Behavior

Ask:

Has this system ever talked to this destination before?
Should it be allowed to?
Is this consistent with its role?

Example:

A workstation scanning other workstations → suspicious
A backup server contacting multiple systems → probably normal

Step 4: Contain Carefully (If Needed)

Only do this if the activity looks abnormal and ongoing.

Containment options (least disruptive first):

Block specific traffic at the firewall
Isolate the system’s VLAN
Disable a single account temporarily

Do not power off systems unless absolutely necessary.

Step 5: Preserve State

Before fixing anything:

Take a VM snapshot if available
Save relevant logs
Record what you observed

This protects your ability to learn from the event.

Outcome (Define “Done”)

You’re finished when one of the following is true:

Activity was confirmed benign and documented
Suspicious activity was contained
Visibility was restored and behavior normalized
You’ve clearly documented what you don’t yet know

Uncertainty is allowed. Silence is not.

After-Action Notes (This Is Where Learning Happens)

Write short answers to:

What confused me?
What took the longest?
What would I do faster next time?
What should this playbook explain better?

Then update the playbook.

That’s not extra work — that is the work.

Glossary Sidebar: Plain-Language Terms

SIEM (Security Information and Event Management)

A central system that collects logs from many places and looks for patterns that matter.

Think of it as:

“Where all the clues come together.”

Lateral Movement

When a system or user moves from one internal system to another, instead of entering from the outside.

This is important because attackers often:

Break into one machine
Then quietly move sideways

Containment

Actions taken to limit damage without destroying evidence.

Containment is not:

Wiping systems
Rebuilding everything
Panic shutdowns

Containment is:

Blocking movement
Isolating affected areas
Buying time to think

VLAN (Virtual Local Area Network)

A way to separate networks logically, even if they share hardware.

In this lab:

VLANs define trust boundaries
Crossing them matters

Trust Boundary

A line where behavior rules change.

Crossing a trust boundary:

Requires permission
Deserves scrutiny
Often triggers alerts

False Positive

An alert that looks suspicious but turns out to be normal.

False positives are not failures — they’re tuning opportunities.

Why This First Playbook Matters

This playbook does something subtle but critical:

It teaches you to:

Slow down
Observe first
Act deliberately
Document reality, not assumptions

You are not expected to “win” incidents yet.

You are expected to respond intentionally.

That’s how operators are made.

Virtology