Skip to main content
Ctrl+K
Rules Bank  documentation - Home Rules Bank  documentation - Home
  • ADK Runbooks

ADK Multi-Agent System

  • Multi-Agent Systems in ADK
  • Multi-Agent Configuration System
  • Configuration-Based Delegation System
  • Configuration System Quick Reference
  • Agent Workflow References

Core Documents:

  • Indicator Handling Protocols
  • Detection Strategy Overview
  • Project Plan: Enhance LLM Agent Context
  • MCP Tool Best Practices & Usage Guide
  • Analytical Query Patterns for AI Agents
  • Automated Response Playbook Criteria
  • Coding Conventions
  • Data Normalization Map
  • Detection Improvement Process for AI Agents
  • Log Source Overview
  • SOP & Automation Effectiveness Review Process

AI Documents:

  • AI Documentation
    • AI Decision Review Guidelines
    • AI Explainability Standards
    • AI Performance Framework: PICERL Index
    • AI Performance Logging Requirements

Atomic Runbooks:

  • Atomic Runbooks
    • Domain-Specific Atomic Runbooks
      • Atomic Runbook: Get Domain Reputation from GTI
      • Atomic Runbook: Get Domain Threat Intel via SecOps MCP
      • Atomic Runbook: Lookup Domain Entity Activity in Chronicle
      • Atomic Runbook: Search Domain DNS Queries in Chronicle
      • Atomic Runbook: Search Domain-Related Network Traffic in Chronicle
    • File Hash-Specific Atomic Runbooks
      • Atomic Runbook: Get File Hash Reputation from GTI
      • Atomic Runbook: Get File Hash Threat Intel via SecOps MCP
      • Atomic Runbook: Lookup File Hash Entity Activity in Chronicle
      • Atomic Runbook: Search File Hash Process Events in Chronicle
    • IP Address-Specific Atomic Runbooks
      • Atomic Runbook: Get IP Address Reputation from GTI
      • Atomic Runbook: Get IP Address Threat Intel via SecOps MCP
      • Atomic Runbook: Lookup IP Entity Activity in Chronicle
      • Atomic Runbook: Search IP Network Traffic in Chronicle
    • URL-Specific Atomic Runbooks
      • Atomic Runbook: Get URL Reputation from GTI
      • Atomic Runbook: Get URL Threat Intel via SecOps MCP
      • Atomic Runbook: Search URL Activity in Chronicle
    • User-Specific Atomic Runbooks
      • Atomic Runbook: Lookup User Entity Activity in Chronicle
      • Atomic Runbook: Search User Login Activity in Chronicle
      • Atomic Runbook: Search User Process Activity in Chronicle

General Security Runbooks:

  • General Security Runbooks
    • Advanced Threat Hunting (Hypothesis-Driven) Runbook
    • Alert Investigation Summary Report Runbook
    • Runbook: APT Threat Hunt
    • Basic Endpoint Triage & Isolation Runbook
    • Basic IOC Enrichment Runbook
    • Case Event Timeline & Process Analysis Workflow
    • Runbook: Generate Case Investigation Report
    • Close duplicate/similar Cases Workflow
    • Cloud Vulnerability Triage & Contextualization
    • Common Investigation Steps
      • Common Step: Check for Duplicate/Similar SOAR Cases
      • Common Step: Close SOAR Case or Alert
      • Common Step: Confirm Action with User
      • Common Step: Correlate IOC with SIEM Alerts & SOAR Cases
      • Common Step: Document Findings/Actions in SOAR Case
      • Common Step: Enrich IOC (GTI + SIEM)
      • Common Step: Find Relevant SOAR Case
      • Common Step: Generate Report File
      • Common Step: Pivot on IOC using GTI Relationships
    • Compare GTI Collection to IoCs, Events in SecOps
    • Runbook: Create Investigation Report
    • Runbook: Data Lake Queries
    • Deep Dive IOC Analysis Runbook
    • SOC Analyst Tier 2 Demo Runbook (SOAR Focus)
    • Runbook: Detection-as-Code Workflow (Placeholder)
    • Runbook: Generate Detection Report
    • Detection Rule Validation & Tuning Runbook
    • Group Cases Workflow
    • Runbook: Group Cases v2
    • Guided TTP Hunt Runbook (Example: Credential Access)
    • Guidelines and Workflows
      • Runbook: Report Writing Guidelines & Template
      • Runbook Guidelines
      • Runbook: SOC Analyst Standard Workflow Guide
      • Runbook: Threat Intelligence Workflows
    • Investigate a Case + external tools
    • Investigate Google Threat Intelligence Collection ID (Enhanced)
    • IOC Containment Runbook
    • Runbook: IOC Threat Hunt
    • Incident Response Plans (IRPs)
      • Compromised User Account Incident Response Plan (IRP) / Runbook
      • Malware Incident Response Plan (IRP) Runbook
      • Phishing Incident Response Plan (IRP) / Runbook
      • Ransomware Incident Response Plan (IRP) / Runbook
    • Lateral Movement Detection Hunt (Example: PsExec/WMI)
    • Malware Triage Runbook
    • Runbook: Meta-Analysis (Placeholder)
    • Post-Incident Review (PIR) Runbook
    • Prioritize and Investigate a Case
    • Proactive Threat Hunting based on GTI Campaign/Actor
    • Suspicious Login Alert Triage Runbook
    • Runbook: Alert Triage
    • Runbook: UEBA Report Analysis
  • Detection-as-Code Rule Tuning Workflow

Templates & Use Cases:

  • Detection Use-Case Package: [USE_CASE_NAME_Placeholder]
  • Atomic Runbook: [Clear, Verb-Oriented Title - e.g., Get_IP_Reputation_From_GTI]
  • Reporting Templates & Guidelines

Security Personas:

  • Security Personas
    • Security Personas
    • Persona: Chief Information Security Officer (CISO)
    • Persona: Compliance Manager
    • Persona: Cyber Threat Intelligence (CTI) Researcher
    • Persona: Detection Engineer
    • Persona: Incident Responder (IR)
    • Persona: Red Team Member
    • Persona: Security Engineer
    • Persona: Tier 1 SOC Analyst
    • Persona: Tier 2 SOC Analyst
    • Persona: Tier 3 SOC Analyst
    • Persona: SOC Manager
    • Persona: Threat Hunter

Agent Workflow References:

  • Agent Workflow References

MCP Tools Integration:

  • Suggested New MCP Tools
  • SOAR MCP Tools Reference
  • SecOps MCP Tools Reference
  • SCC MCP Tools Reference

Development & Planning:

  • Project Plan: Enhance LLM Agent Context
  • Repository
  • Suggest edit
  • Open issue
  • .md

AI Documentation

AI Documentation#

This section delves into the specifics of Artificial Intelligence (AI) integration within our security operations. It covers guidelines for AI decision-making, standards for ensuring AI systems are explainable, frameworks for measuring AI performance (like the PICERL model), and requirements for logging AI activities. These documents are crucial for understanding how AI agents are designed, operated, reviewed, and continuously improved to enhance our security posture.

AI Documents

  • AI Decision Review Guidelines
    • Purpose
    • Scope of Review
    • Review Frequency & Sampling
    • Standardized Feedback Format
    • Feedback Integration & Learning Loop
    • Responsibilities
    • References and Inspiration
  • AI Explainability Standards
    • Purpose
    • Core Principles of AI Explanations
    • Standards for “Good” AI Explanations
    • Templates for AI-Generated Summaries / Explanations
    • Measuring Explainability
    • References and Inspiration
  • AI Performance Framework: PICERL Index
  • References
    • The PICERL Index Overview
    • Phase Breakdown, rules-bank Support, and Key AI Metrics
    • References and Inspiration
  • AI Performance Logging Requirements
    • Purpose
    • General Logging Principles for AI Agents
    • Key Data Points to Log per AI Action/Decision Type
    • Log Storage & Accessibility

previous

SOP & Automation Effectiveness Review Process

next

AI Decision Review Guidelines

By Your Name/Organization

© Copyright 2025, Your Name/Organization.