response-playbooks

Response Playbooks

Turn detections into automated response. This skill analyzes what a detection looks for, recommends tiered response actions appropriate to the threat, and hands off to fusion-workflows for workflow YAML generation. It bridges the gap between "alert fires" and "something happens."

Response architect, not workflow builder. This skill decides what response fits a detection. The fusion-workflows skill builds the actual workflow YAML.

When to Use This Skill

• You have detections deployed (or proposed) and need response automation
• You want to design SOAR playbooks for a set of detections
• You need to map detection severity/type to appropriate response actions
• You're deciding which detections warrant automated containment vs. notification-only

Handoff Input

This skill accepts:

• Direct invocation — user points at detections by name, file path, or description
• Handoff doc from source-threat-modeling — read the doc and use its context for Phase 1

If consuming a handoff doc, skip Phase 1 questions already answered in the doc.

---

Phase 1: Detection Intake

Goal: Understand what each detection looks for and what's at stake.

For each detection the user wants response automation for:

Step 1: Read the detection

• If it's a deployed detection: read from resources/detections/
• If it's from a handoff doc: read the context provided
• If described verbally: ask enough questions to understand the threat

Gather:

• Detection name and CQL logic
• Severity level
• MITRE ATT&CK mapping (technique + tactic)

Step 2: Identify the center entity

What is the primary subject of this detection?

Entity Type	Examples
User account	Identity-based threats — credential attacks, privilege escalation
Host/endpoint	Malware, LOLBins, persistence, lateral movement
IP address	Network-based threats — C2, scanning, exfiltration
Cloud resource	Infrastructure threats — config changes, IAM abuse
Application	SaaS/app-level threats — data theft, API abuse