Quick Snapshot: What's Most Pressing Right Now?

• In one sentence, what incident or staffing pressure brought you to consider orchestration now?
• How many incidents in the last 30 days took longer than one hour to contain? Options: 0–5, 6–20, 21–50, 51–200, 200+
• Which two playbook scenarios would you prioritize for a proof-of-value (pick up to two)? Options: Phishing triage, Endpoint isolation, Account compromise response, Malware investigation, SIEM enrichment and triage, Other
• Describe a specific recent incident (within 30 days) we could replay for evaluation — what happened, which tools were involved, and how long did containment take?
• Who is your internal champion and the day-to-day owner for this evaluation (name, role, contact), and who needs to be kept in the loop?

Why Did This Take Eight Hours?

• When you replay the worst-case incident, which manual handoffs or copy-paste tasks drained the most time and why?
• Which consoles or systems did analysts repeatedly copy information between during that event? Options: SIEM (Splunk/QRadar/Elastic), EDR (CrowdStrike/SentinelOne/Carbon Black), Email gateway (Proofpoint/Microsoft), Threat intel platform, Ticketing (ServiceNow/Jira), Firewall/Proxy, Identity (Okta/AD), On-prem legacy systems, Other
• On average, how long does an analyst spend per typical case today (minutes)? Options: <10, 10–30, 30–60, 60–180, 180+
• Which steps in your current triage workflow are reliably repeatable versus those that require human judgment? Options: Indicator enrichment (repeatable), Querying SIEM/logs (repeatable), Correlation and context (semi-repeatable), Decision to isolate or block (needs judgment), Escalation to IR/management (needs judgment), Other
• How did the team feel during and after that incident—burnout, frustration, relief? Share a brief example of impact on morale or retention.

If Automation Did Half the Work, What Would That Free Up?

• Imagine 30% of your daily alerts were safely handled by playbooks — what would your team do with the reclaimed time?
• Which measurable success signals will convince you the platform is delivering value? Options: Playbook run <2 minutes, Playbook run <30 seconds, Analyst hours reclaimed/week, Reduction in mean time to contain (MTTC), Fewer escalations to IR, Lower false positives, Other
• For phishing triage and endpoint isolation specifically, what time-to-complete would you consider a win? Options: <8 seconds, <30 seconds, <2 minutes, <5 minutes, Other
• How will you quantify ROI for this evaluation—analyst hours, FTEs avoided, reduced incident costs, SLA improvements, or something else? Options: Analyst hours/week, FTEs reclaimed, Cost per incident reduction, MTTR/MTTC improvement, SLA attainment, Other
• Who must approve the success metrics and final evaluation sign-off (roles)? Options: SOC Manager, VP Security Ops, CISO, IT Ops/Infrastructure, Compliance/Legal, Finance/Procurement, Other

Are You Worried Automation Could Make Things Worse?

• What specific scenarios or past experiences make you nervous about automating response actions in production?
• Which response actions would you consider safe to automate right away, and which must remain advisory until proven? Options: Quarantine endpoint, Disable user account, Remove/quarantine email, Block URL/IP on perimeter, Enrich ticket and add context, Notify owner only (advisory), Other
• Have you ever had a misconfiguration or automation error cause an unsafe action? If so, what happened and how did you recover?
• Do you have rollback controls or emergency stop processes for automated actions today? Options: Yes — automated rollback workflows, Yes — manual rollback procedures, Partial/unclear, No
• What logging, audit trail, and retention requirements must any automation solution meet for compliance or post-incident review? Options: Full playbook audit logs, Action-level change history, SIEM forwarding of events, Immutable logs/retention policy, Other
• Who on your team is authorized to halt an automated run mid-flight, and how should that be accessible during an incident? Options: SOC Manager, Shift Lead, Senior Analyst, IR Lead, No single owner / CAB

Toolbelt Inventory — What's Actually in the Room?

• If I listed every tool your analysts touch, what critical system might I miss?
• Select the tools and vendors you currently run in your SOC (pick all that apply). Options: Splunk, Elastic, IBM QRadar, CrowdStrike, SentinelOne, VMware Carbon Black, Microsoft Defender, Proofpoint/Microsoft 365 Email, ServiceNow, Jira/ConnectWise, Recorded Future/Threat Intel, Okta/Active Directory
• Are any critical systems on-premise or air-gapped in a way that will complicate integration? Options: Yes — on-prem with limited API access, Yes — air-gapped/isolated, Mostly cloud with APIs, Mixed environment
• For the connectors we’ll need during evaluation, what is the current state of credentials/service accounts? Options: All needed accounts/keys available, Some available, will need admin help, None available — provisioning required, Unsure
• How strict is your approval/change-control process for adding new connectors or playbooks (expected lead time)? Options: Very strict (>4 weeks), Moderate (1–4 weeks), Light (<1 week), Ad-hoc/varies

Who's in the Room When Things Change?

• If a playbook could quarantine an endpoint or disable an account, who must be consulted or sign off before that action runs?
• Map the stakeholders for adoption — who approves, who operates day-to-day, and who audits or reviews results (select all that apply). Options: SOC Manager, Shift Lead/Analyst, Incident Response Lead, VP Security Ops, CISO, IT Ops/Infrastructure, Legal/Compliance, Finance/Procurement, MSSP/Third-party
• Which business units, services, or applications would be high-risk if an automated action misfired?
• Do you use external partners (MSSPs or MSPs) who will require access, shared visibility, or different modes of control? Options: Yes — MSSP with shared access, Yes — MSP with limited access, No external partners, Unsure
• How do you prefer advisory vs automated modes be documented and approved for rollout (process or artifact)? Options: Formal change request / RFC, Ticket-based approvals, CAB meeting sign-off, Email approvals from stakeholders, Other
• What training, runbooks, or shadowing would make your analysts comfortable enabling auto-response? Options: Hands-on workshops, Recorded modules + quizzes, Shadowing sessions, Written runbooks + playbooks, Combination

Ready for a Small Win — What's Our First Test?

• Which single real incident from the last 30 days would you most want us to automate end-to-end during evaluation, and why is that case meaningful?
• Can you provide a sanitized incident packet for that case (logs, IOC list, timeline)? Options: Yes — ready to share, Yes — will need time to sanitize, No — can export but not sanitize, No — cannot share
• What blackout windows or operational constraints should we avoid when running tests in your environment? Options: Business hours, Scheduled maintenance windows, Regulatory reporting periods, Peak traffic periods, None, Other
• Immediately after a test run, how will you judge success—time savings, no service impact, analyst confidence, or something else? Options: Time-to-complete reduction, Accuracy parity with manual, No negative impact on services, Positive analyst feedback, Documented rollback performance, Other
• Who should attend the live demo and the post-run retrospective (roles and names if known)?
• Realistically, how soon can you make a test/sandbox environment available or provide scoped production access for evaluation? Options: Immediately, Within 1 week, 1–3 weeks, 3–6 weeks, Longer

• Pre-Workshop: Incident Intake & Current-State Confirmation
• Playbook Build Workshop — Phishing Triage (Sandbox)
• Playbook Build Workshop — Endpoint Isolation (Sandbox)
• Run & Measurement Session — Execute Playbooks on Recent Incidents
• Safety Review, Acceptance & Handoff to Deployment

• Produce a first-cut measurement of analyst hours reclaimed and projected weekly ROI for the monitored alert types.
• Customer to provide any missing email samples or enrichment sources identified during the build.
• Customer SOC lead to review and sign off on the defined acceptance criteria and safety gates for phishing.
• Both parties to schedule the validation run and measurement session.
• Reaffirm Current State & Desired Future Outcome
• Deliver a tested endpoint isolation playbook in sandbox with documented rollback and safety controls.
• Verify the playbook's execution time and confirm it meets the defined acceptance criteria in controlled tests.
• Identify any operational blockers (EDR permissions, business-critical host lists) to address before validation on real incidents.
• Customer to provide a test host or lab endpoint for final sandbox validation and to supply allowlist/critical-host inventory.
• Seller to document rollback procedures and failure-mode behaviors for handoff to the customer's ops team.
• Customer IT/Security to verify EDR API access and approve least-privilege account for validation runs.
• Readout of Baseline Metrics & Success Criteria
• Demonstrate that each playbook executes successfully and measure the exact time-to-complete on real incidents.
• Obtain explicit customer validation that the automated outcomes match the desired future state and eliminate the pain points described.
• Document any remaining fixes or controls required before moving to advisory/automated deployment modes.
• Introductions & Objectives
• Seller to deliver a run report with timestamps, logs, screenshots, and a comparison to baseline times.
• Customer to confirm acceptance or list required adjustments within X business days (template sign-off).
• Both parties to capture any required playbook changes and schedule a remediation window if needed.
• Readout of Run Results & Measured Savings
• Obtain formal acceptance (or list of required fixes) for both playbooks based on measured runs.
• Confirm safety/rollback behavior is adequate and assign owners for deployment readiness tasks.
• Decide the immediate next mode of operation (advisory in prod, limited automation, or full automation) and schedule Deployment Enablement.
• Ensure a clear handoff package (playbook artifacts, run logs, acceptance criteria) is assigned to Deployment owners.
• Seller to produce a final acceptance package including run reports, playbook exports, and remediation backlog.
• Customer to sign acceptance or provide a prioritized remediation list within the agreed SLA.
• Both parties to schedule Deployment Readiness and Enablement sessions and assign owners for monitoring and rollback SLAs.
• Capture a single-sentence current state for each incident type (phishing, endpoint isolation).
• Quantify baseline manual time-per-case and weekly analyst hours lost for both incident types.
• Confirm required integrations, test accounts, and pre-work completed so playbook builds can proceed without delay.
• Schedule the playbook build workshops and assign owners for artifacts and access.
• Customer to deliver full incident artifacts (email headers, EDR traces, SIEM correlation searches, ticket history) for both test incidents.
• Customer to grant read-only API/test accounts or provide sandbox endpoints for connectors required in playbooks.
• Seller to prepare a brief baseline worksheet template to capture manual step timings and cost assumptions.
• Both parties to confirm attendees and schedule two 90-minute build workshops (one per playbook).
• Recap Current State & Future State Target
• Produce a working phishing triage playbook in sandbox/advisory mode tailored to the customer's incident.
• Demonstrate that the playbook completes the scripted path and capture initial execution time and artifacts.
• Agree on acceptance criteria and safety gates to be validated in the run session.
• List any integration gaps, data mappings, or policy constraints needing resolution before production runs.
• Seller to finalize playbook in sandbox and export run logs, screenshots, and execution timing.
• Phishing Playbook Run & Live Measurement
• One‑Sentence Current State
• Safety-First Design: Guardrails & Rollback
• Review Safety Tests & Failure Modes
• Map Manual Steps to Playbook Actions
• Acceptance Review Against Criteria
• Incident Walkthroughs (Phishing + Endpoint)
• Endpoint Isolation Run & Safety Validation
• Map EDR & ITSM Actions, Roles, and Escalation
• Define Acceptance Criteria & Safety Gates
• Consequence Mapping: Time, Risk, Cost
• Author Playbook Steps & Configure Connectors
• Author Playbook Steps & Configure EDR Connector
• Deployment Readiness Checklist & Roles
• Triage of Unexpected Results & Tune
• Pre-Work & Integration Checklist
• Run Controlled Tests & Validate Rollback
• Quantify Time Savings & Analyst Hour Impact
• Execute Sandbox Runs & Record Metrics

• Integrate SIEM Connector and Event Ingestion
• Integrate EDR Connector and Action Controls
• Integrate Threat Intelligence Feed(s)
• Integrate Email Gateway / Phishing Reporter Connector
• Deploy Phishing Triage Playbook (advisory mode)
• Deploy Endpoint Isolation Playbook (advisory mode)
• Automate IOC Enrichment and Contextualization
• Automate Ticket Creation and Update in ITSM
• Enable Parallel API Execution Engine
• Enable Advisory-to-Automated Response Toggle
• Deploy URL and Attachment Detonation Sandbox Integration
• Implement Role-Based Playbook Permissions and Audit Logging
• Deploy Legacy On-Prem Connector for Custom Systems

Integrate SIEM Connector and Event Ingestion

• Which SIEM(s) are in use in scope for this integration? Options: Splunk, Elastic SIEM, QRadar, Microsoft Sentinel, ArcSight, Other
• What event forwarding method is available/preferred (how will events be ingested)? Options: Syslog, API / direct ingestion, Collector / forwarder agent, File export / S3, Other
• What is the estimated daily event volume (rough ranges) we should plan for? Options: Less than 10k/day, 10k-100k/day, 100k-1M/day, More than 1M/day, Unknown
• Which specific event types and fields must be ingested or normalized (e.g., alerts, logs, enriched fields)?
• Do you require filtered/curated event subsets (noise reduction) before playbook triggering? Options: Yes, No
• Who will provide SIEM access credentials, and who is the technical contact for onboarding?

Integrate EDR Connector and Action Controls

• Which EDR vendor(s) are in use and need connectors? Options: CrowdStrike, Carbon Black, Microsoft Defender for Endpoint, SentinelOne, Sophos, Other
• Which containment/remediation actions should be permitted by automation? Options: Isolate network, Quarantine/kill process, Collect forensic artifacts, Block hash/file, Rollback changes, Other
• What approval model should govern EDR actions during evaluation (advisory vs manual approval vs auto)? Options: Advisory only, Tiered analyst approval, Manager approval required, Auto with safeguards
• What authentication model is available for EDR integration (service account, API key, certificate)? Options: API key, OAuth2 / token, Mutual TLS / certificate, Jump host / bastion, Other
• How many endpoints are in scope (approximate fleet size) for playbook actions? Options: Less than 100, 100-1,000, 1,000-10,000, More than 10,000, Unknown
• Who is the owner for EDR connector maintenance and incident approvals? Options: SOC Manager, Endpoint Ops, IR Lead, Platform Admin, Other

Integrate Threat Intelligence Feed(s)

• Which threat intelligence feeds or platforms should be integrated? Options: VirusTotal, Recorded Future, MISP / OpenTI, AlienVault OTX, Internal TI database, Other
• What enrichment attributes do you require from TI (e.g., reputation, first seen, confidence, malware family)? Options: Reputation score, Confidence level, Malware family, TTP mapping, First seen / last seen, Other
• Do you prefer push (feed pushes indicators) or pull (platform queries feed) integration? Options: Pull, Push, Both
• What refresh cadence is acceptable for indicators (real-time, hourly, daily)? Options: Real-time / streaming, Hourly, Daily, On-demand
• How should false positives and whitelisted indicators be handled? Options: Manual review and mark, Auto-whitelist with TTL, Tag but still surface to analyst, Other
• Who owns the TI mapping/validation process in your organization? Options: Threat Intel team, SOC Manager, IR Team, No dedicated owner

Integrate Email Gateway / Phishing Reporter Connector

• Which email gateway or phishing reporter systems are in scope? Options: Proofpoint, Mimecast, Microsoft Defender for Office 365 / Exchange, Google Workspace, Other
• How are user-reported phishing messages currently delivered for triage (reported mailbox, API, forwarding)? Options: Reported mailbox ingestion, API integration, Automated forwarding rule, Security awareness tool, Other
• Which automated actions should be available from reported emails? Options: Quarantine message, Block sender, Extract attachments for detonation, Create ticket, Notify user/owner, Other
• Are there PII, legal, or privacy constraints to sending message content to external sandboxes or services? Options: Yes, No
• What is the typical daily volume of reported messages to be ingested for evaluation? Options: Less than 10/day, 10-50/day, 50-200/day, 200+/day, Unknown
• Please provide the mailbox, API owner, or contact responsible for the phishing reporter integration.

Deploy Phishing Triage Playbook (advisory mode)

• Do you want a phishing triage playbook built and run against recent incidents for evaluation? Options: Yes, No
• Which triage steps should the playbook include for the phishing scenario? Options: URL reputation lookup, Attachment detonation, Header analysis, Inbox/email search for related messages, Account disable / lock, Create/update ticket
• What are the acceptance criteria for the phishing playbook (time-to-complete target, detection accuracy, minimal false positives)?
• Provide 1-3 recent phishing incidents or sample emails (within last 30 days) for testing.
• Who will validate advisory playbook outputs (roles that will review results)? Options: Tier 1 Analyst, Tier 2 Analyst, SOC Manager, Threat Intel, Other
• What rollback or mitigation controls do you require while running in advisory mode? Options: Manual rollback only, Auto-rollback if preconditions fail, Admin approval required, Other

Deploy Endpoint Isolation Playbook (advisory mode)

• Do you want an endpoint isolation playbook built and executed in advisory mode for evaluation? Options: Yes, No
• Which signals should be allowed to trigger the isolation playbook? Options: EDR alert, SIEM correlation rule, Manual analyst request, TI indicator match, User report, Other
• Which isolation actions should be simulated or performed in advisory mode? Options: Simulate only (no action), Notify stakeholders only, Block network access, Disable user sessions, Collect artifacts only
• Is there a staging/test endpoint pool available for safe validation? Options: Yes, No
• What criteria should be used to avoid isolating critical infrastructure or false positives (whitelists, asset tags)?
• Who must approve any move from advisory to automated isolation for production endpoints? Options: SOC Manager, IR Lead, CISO, Platform Admin, Other

Automate IOC Enrichment and Contextualization

• Which IOC types should be enriched automatically? Options: IP address, URL, Domain, File hash, Email address, Other
• Which enrichment sources should be prioritized (TI feeds, passive DNS, EDR tags, internal DB)? Options: Threat feeds, Passive DNS, EDR telemetry, SIEM context, Internal asset DB, Other
• What contextual fields are required in the enrichment (e.g., ASN, geolocation, owner, first seen)?
• What SLA do you expect for IOC enrichment (seconds, under 1 minute, under 5 minutes)? Options: Realtime / <5s, <1 minute, <5 minutes, No SLA
• How should conflicting enrichment results be reconciled (authoritative source, append all, analyst review)? Options: Choose authoritative source, Append all with provenance, Flag for manual review
• Who owns validation of enrichment accuracy and the mapping of fields? Options: Threat Intel, SOC Analyst, Platform Admin, IR Team, Other

Automate Ticket Creation and Update in ITSM

• Which ITSM platform(s) must be integrated for ticket creation/updates? Options: ServiceNow, Jira Service Management, BMC Remedy, Zendesk, Other
• Which ticket fields must be auto-populated (short description, severity, affected host, owner, artifacts)?
• What conditions should trigger ticket creation vs ticket update vs suppression? Options: New alert, Playbook completes, Containment action taken, Analyst marks for ticket, Other
• What is the expected ticket lifecycle and closure criteria to align with your SLAs?
• Do you require bi-directional sync (updates in ITSM reflected back to the platform)? Options: Yes, No
• Who will manage ITSM connector credentials and mapping ownership?

Enable Parallel API Execution Engine

• Are there playbooks or actions that would benefit from parallel API execution? Options: Yes, No
• Which specific integrations/steps do you expect to run in parallel (e.g., reputation checks, EDR queries, sandbox detonation)?
• What maximum concurrent API calls are acceptable given vendor rate limits? Options: Unknown, <10, 10-50, 50-200, 200+
• Preferred handling for rate limits and API failures (throttle, exponential backoff, queue and retry, fail-fast)? Options: Throttle, Exponential backoff, Queue and retry, Fail-fast
• What performance acceptance criteria should parallel execution meet (end-to-end playbook time)?

Enable Advisory-to-Automated Response Toggle

• Do you plan to convert advisory playbooks to automated response during the engagement or after validation? Options: During evaluation, Only after formal validation, No—remain advisory
• What conditions or KPIs must be met to flip a playbook to automated mode (time savings, error rate, sandbox results)?
• Which playbook categories should never be automated (e.g., account disable, domain takedown)?
• What approval workflow should be used to change advisory/automated state (in-app approval, CAB ticket, email sign-off)? Options: In-app approval, Change Advisory Board (CAB) ticket, Email sign-off, Other
• Who is authorized to toggle a playbook to automated mode? Options: SOC Manager, IR Lead, CISO, Platform Admin, Other
• Should automated-mode enablement include automatic rollback triggers (e.g., if false positives exceed threshold)? Options: Yes, No

Deploy URL and Attachment Detonation Sandbox Integration

• Which sandbox(s) should be integrated for URL and attachment detonation? Options: Cuckoo, FireEye / Mandiant, ReversingLabs, Hybrid Analysis, Cloud commercial sandbox, In-house / custom

• Non-Disclosure Agreement (NDA)
• Master Services Agreement (MSA)
• Statement of Work (SOW)
• Commercial Quote & Order Form
• Data Processing & Privacy Addendum (DPA)
• Data & Access Agreement
• Automation Mode Consent
• Rollback Controls & Safety Playbook
• Success Measurement & Acceptance Criteria
• Implementation Plan & Schedule
• Change Control & Governance Agreement
• Training & Knowledge Transfer Agreement
• Service Level Agreement (SLA) & Support
• Termination & Exit Plan

• Success Review & Acceptance
• ROI & Operational Impact Review
• Post-Deployment Safety & Improvement Workshop
• Ongoing Ops Cadence & Shared Channel Setup

• Schedule the standing ops syncs and add calendar invites with owners and pre-work requirements.
• Establish the cadence and owner for ongoing ROI measurement.
• Create and deliver an ROI dashboard (weekly refresh) showing reclaimed hours, cost equivalent, and trend lines.
• Document prioritized backlog of playbooks for expansion and assign product/ops owners.
• Define and schedule a quarterly business review to revisit ROI and expansion decisions.
• Create a set of reproducible test cases for each high-priority issue.
• Runbook & Incident Recap
• Capture all safety and correctness issues from live runs and assign remediation owners.
• Agree on an incremental tuning and release plan that preserves advisory-mode safeguards until proven.
• Create tickets for each identified safety/correctness issue with severity, owner, and target remediation date.
• Build and store acceptance test cases (playbook inputs and expected outputs) in the customer's test repo.
• Update rollback and access-control documentation and publish to the shared channel.
• Purpose & Scope of Shared Channel
• Create a functioning shared channel with the correct membership and permissions.
• Agree on escalation, change-control, and rollback procedures to keep automations safe.
• Establish a recurring meeting cadence and backlog process to ensure continuous improvement.
• Create the shared channel, invite the agreed membership, and post the onboarding note and runbook links.
• Publish the escalation matrix and change-control checklist to the channel and attach to each playbook owner profile.
• Introductions & Objectives
• Validate that each pilot playbook meets the documented success signals.
• Capture precise reclaimed analyst hours per week and agree on the measurement method.
• Obtain customer sign-off or a defined remediation plan with owners and dates.
• Publish the final acceptance report including raw metrics, traces, and reclaimed-hours calculation.
• If any acceptance criteria failed, create a remediation ticket with owner, acceptance target, and timeline.
• Update the customer's baseline vs outcome slide deck and share to the agreed channel.
• Executive Summary of Outcomes
• Agree on a documented ROI figure and the assumptions behind it.
• Decide the next set of playbook expansions or pilots with clear criteria.
• Current State (one-sentence)
• Channel Setup & Access Roles
• Reclaimed Hours & Cost Model
• False Positive / False Negative Analysis
• Operational Impact Metrics
• Consequence Summary
• Safety Controls & Rollback Review
• Escalation & Change-Control Process
• Expansion Prioritization
• Playbook Tuning & Acceptance Tests
• Measured Outcomes (Before vs After)
• Cadence & Meeting Calendar
• Live Playbook Trace / Evidence
• Prioritization of Fixes and Enhancements
• Backlog Management & SLAs
• Decision: Expand, Pilot, or Pause
• Acceptance Criteria Checklist
• Sign-off, Next Steps & Owners