Threat Overview
Description of the threat type and potential impact.
4.8
on G2
Free Process Template
Security procedures for [threat] detection and response
Use this template to security procedures for [threat] detection and response.
| Field | Details |
|---|---|
| Category | Process |
| Owner | [Team or owner] |
| Version | [Version number] |
| Effective Date | [Date] |
| Review Cycle | [Monthly / Quarterly / Annual / Event-based] |
| Status | [Draft / In Review / Approved] |
Description of the threat type and potential impact.
| Item | Details | Owner | Status |
|---|---|---|---|
| [Item or requirement] | [Describe the relevant detail, evidence, or decision] | [Owner] | [Open / Complete] |
| [Item or requirement] | [Describe the relevant detail, evidence, or decision] | [Owner] | [Open / Complete] |
[Add context, assumptions, exceptions, evidence links, screenshots, calculations, or reviewer comments.]
IOCs, alerts, and log patterns that indicate this threat.
| Item | Details | Owner | Status |
|---|---|---|---|
| [Item or requirement] | [Describe the relevant detail, evidence, or decision] | [Owner] | [Open / Complete] |
| [Item or requirement] | [Describe the relevant detail, evidence, or decision] | [Owner] | [Open / Complete] |
[Add context, assumptions, exceptions, evidence links, screenshots, calculations, or reviewer comments.]
Immediate steps to limit the threat's impact.
| Item | Details | Owner | Status |
|---|---|---|---|
| [Item or requirement] | [Describe the relevant detail, evidence, or decision] | [Owner] | [Open / Complete] |
| [Item or requirement] | [Describe the relevant detail, evidence, or decision] | [Owner] | [Open / Complete] |
[Add context, assumptions, exceptions, evidence links, screenshots, calculations, or reviewer comments.]
Steps to remove the threat from the environment.
| Item | Details | Owner | Status |
|---|---|---|---|
| [Item or requirement] | [Describe the relevant detail, evidence, or decision] | [Owner] | [Open / Complete] |
| [Item or requirement] | [Describe the relevant detail, evidence, or decision] | [Owner] | [Open / Complete] |
[Add context, assumptions, exceptions, evidence links, screenshots, calculations, or reviewer comments.]
Steps to restore normal operations.
| Item | Details | Owner | Status |
|---|---|---|---|
| [Item or requirement] | [Describe the relevant detail, evidence, or decision] | [Owner] | [Open / Complete] |
| [Item or requirement] | [Describe the relevant detail, evidence, or decision] | [Owner] | [Open / Complete] |
[Add context, assumptions, exceptions, evidence links, screenshots, calculations, or reviewer comments.]
What to preserve for forensic analysis.
| Item | Details | Owner | Status |
|---|---|---|---|
| [Item or requirement] | [Describe the relevant detail, evidence, or decision] | [Owner] | [Open / Complete] |
| [Item or requirement] | [Describe the relevant detail, evidence, or decision] | [Owner] | [Open / Complete] |
[Add context, assumptions, exceptions, evidence links, screenshots, calculations, or reviewer comments.]
Who to notify and required compliance reports. Use Markdown with code blocks. Write for urgency.
| Item | Details | Owner | Status |
|---|---|---|---|
| [Item or requirement] | [Describe the relevant detail, evidence, or decision] | [Owner] | [Open / Complete] |
| [Item or requirement] | [Describe the relevant detail, evidence, or decision] | [Owner] | [Open / Complete] |
[Add context, assumptions, exceptions, evidence links, screenshots, calculations, or reviewer comments.]
Document review conclusions, approvals, unresolved items, and next review date.
| Role | Name | Date | Notes |
|---|---|---|---|
| Preparer | [Name] | [Date] | [Notes] |
| Reviewer | [Name] | [Date] | [Notes] |
| Approver | [Name] | [Date] | [Notes] |
Template Structure
Use this process template as a starting point, then customize each section to match your internal workflow, evidence, and signoff needs.
Description of the threat type and potential impact.
IOCs, alerts, and log patterns that indicate this threat.
Immediate steps to limit the threat's impact.
Steps to remove the threat from the environment.
Steps to restore normal operations.
What to preserve for forensic analysis.
Who to notify and required compliance reports. Use Markdown with code blocks. Write for urgency.
Write a Security Runbook. Structure with:
Description of the threat type and potential impact.
IOCs, alerts, and log patterns that indicate this threat.
Immediate steps to limit the threat's impact.
Steps to remove the threat from the environment.
Steps to restore normal operations.
What to preserve for forensic analysis.
Who to notify and required compliance reports.
Use Markdown with code blocks. Write for urgency.
A production API key has been exposed (e.g., committed to public repository, found in logs, reported by user). The key may allow unauthorized access to customer data and service operations.
# Disable in API gateway
curl -XPATCH https://admin.internal/api/keys/KEY_ID \
-H "Authorization: Bearer $ADMIN_TOKEN" \
-d '{"status": "revoked"}'
aws waf update-ip-set --name "blocked-ips" --addresses "1.2.3.4/32"
Record a walkthrough, training session, or process demonstration. Docsie AI turns it into structured documentation using this template as the starting framework.
Use the template manually, or let Docsie generate the first draft from source footage.
Process for implementing [change] with rollback
Response procedures for [incident type]
Daily procedures for [system] maintenance
Step-by-step process for [task]
Template FAQ
Common questions about using and generating a security Runbook.
Q: What is a security Runbook?
A: A security Runbook is a structured document for security procedures for [threat] detection and response.
Q: Can I download this security Runbook as Word or PDF?
A: Yes. This page includes free downloads in DOCX, PDF, and Markdown formats so you can edit, share, or import the template into your documentation system.
Q: Can Docsie generate this from a video?
A: Yes. Upload a process walkthrough, training recording, or screen capture to Docsie, then use this template structure to generate a first draft automatically.