Skip to main content
Ctrl+K
Rules Bank  documentation - Home Rules Bank  documentation - Home
  • ADK Runbooks

ADK Multi-Agent System

  • Multi-Agent Systems in ADK
  • Multi-Agent Configuration System
  • Configuration-Based Delegation System
  • Configuration System Quick Reference
  • Agent Workflow References

Core Documents:

  • Indicator Handling Protocols
  • Detection Strategy Overview
  • Project Plan: Enhance LLM Agent Context
  • MCP Tool Best Practices & Usage Guide
  • Analytical Query Patterns for AI Agents
  • Automated Response Playbook Criteria
  • Coding Conventions
  • Data Normalization Map
  • Detection Improvement Process for AI Agents
  • Log Source Overview
  • SOP & Automation Effectiveness Review Process

AI Documents:

  • AI Documentation
    • AI Decision Review Guidelines
    • AI Explainability Standards
    • AI Performance Framework: PICERL Index
    • AI Performance Logging Requirements

Atomic Runbooks:

  • Atomic Runbooks
    • Domain-Specific Atomic Runbooks
      • Atomic Runbook: Get Domain Reputation from GTI
      • Atomic Runbook: Get Domain Threat Intel via SecOps MCP
      • Atomic Runbook: Lookup Domain Entity Activity in Chronicle
      • Atomic Runbook: Search Domain DNS Queries in Chronicle
      • Atomic Runbook: Search Domain-Related Network Traffic in Chronicle
    • File Hash-Specific Atomic Runbooks
      • Atomic Runbook: Get File Hash Reputation from GTI
      • Atomic Runbook: Get File Hash Threat Intel via SecOps MCP
      • Atomic Runbook: Lookup File Hash Entity Activity in Chronicle
      • Atomic Runbook: Search File Hash Process Events in Chronicle
    • IP Address-Specific Atomic Runbooks
      • Atomic Runbook: Get IP Address Reputation from GTI
      • Atomic Runbook: Get IP Address Threat Intel via SecOps MCP
      • Atomic Runbook: Lookup IP Entity Activity in Chronicle
      • Atomic Runbook: Search IP Network Traffic in Chronicle
    • URL-Specific Atomic Runbooks
      • Atomic Runbook: Get URL Reputation from GTI
      • Atomic Runbook: Get URL Threat Intel via SecOps MCP
      • Atomic Runbook: Search URL Activity in Chronicle
    • User-Specific Atomic Runbooks
      • Atomic Runbook: Lookup User Entity Activity in Chronicle
      • Atomic Runbook: Search User Login Activity in Chronicle
      • Atomic Runbook: Search User Process Activity in Chronicle

General Security Runbooks:

  • General Security Runbooks
    • Advanced Threat Hunting (Hypothesis-Driven) Runbook
    • Alert Investigation Summary Report Runbook
    • Runbook: APT Threat Hunt
    • Basic Endpoint Triage & Isolation Runbook
    • Basic IOC Enrichment Runbook
    • Case Event Timeline & Process Analysis Workflow
    • Runbook: Generate Case Investigation Report
    • Close duplicate/similar Cases Workflow
    • Cloud Vulnerability Triage & Contextualization
    • Common Investigation Steps
      • Common Step: Check for Duplicate/Similar SOAR Cases
      • Common Step: Close SOAR Case or Alert
      • Common Step: Confirm Action with User
      • Common Step: Correlate IOC with SIEM Alerts & SOAR Cases
      • Common Step: Document Findings/Actions in SOAR Case
      • Common Step: Enrich IOC (GTI + SIEM)
      • Common Step: Find Relevant SOAR Case
      • Common Step: Generate Report File
      • Common Step: Pivot on IOC using GTI Relationships
    • Compare GTI Collection to IoCs, Events in SecOps
    • Runbook: Create Investigation Report
    • Runbook: Data Lake Queries
    • Deep Dive IOC Analysis Runbook
    • SOC Analyst Tier 2 Demo Runbook (SOAR Focus)
    • Runbook: Detection-as-Code Workflow (Placeholder)
    • Runbook: Generate Detection Report
    • Detection Rule Validation & Tuning Runbook
    • Group Cases Workflow
    • Runbook: Group Cases v2
    • Guided TTP Hunt Runbook (Example: Credential Access)
    • Guidelines and Workflows
      • Runbook: Report Writing Guidelines & Template
      • Runbook Guidelines
      • Runbook: SOC Analyst Standard Workflow Guide
      • Runbook: Threat Intelligence Workflows
    • Investigate a Case + external tools
    • Investigate Google Threat Intelligence Collection ID (Enhanced)
    • IOC Containment Runbook
    • Runbook: IOC Threat Hunt
    • Incident Response Plans (IRPs)
      • Compromised User Account Incident Response Plan (IRP) / Runbook
      • Malware Incident Response Plan (IRP) Runbook
      • Phishing Incident Response Plan (IRP) / Runbook
      • Ransomware Incident Response Plan (IRP) / Runbook
    • Lateral Movement Detection Hunt (Example: PsExec/WMI)
    • Malware Triage Runbook
    • Runbook: Meta-Analysis (Placeholder)
    • Post-Incident Review (PIR) Runbook
    • Prioritize and Investigate a Case
    • Proactive Threat Hunting based on GTI Campaign/Actor
    • Suspicious Login Alert Triage Runbook
    • Runbook: Alert Triage
    • Runbook: UEBA Report Analysis
  • Detection-as-Code Rule Tuning Workflow

Templates & Use Cases:

  • Detection Use-Case Package: [USE_CASE_NAME_Placeholder]
  • Atomic Runbook: [Clear, Verb-Oriented Title - e.g., Get_IP_Reputation_From_GTI]
  • Reporting Templates & Guidelines

Security Personas:

  • Security Personas
    • Security Personas
    • Persona: Chief Information Security Officer (CISO)
    • Persona: Compliance Manager
    • Persona: Cyber Threat Intelligence (CTI) Researcher
    • Persona: Detection Engineer
    • Persona: Incident Responder (IR)
    • Persona: Red Team Member
    • Persona: Security Engineer
    • Persona: Tier 1 SOC Analyst
    • Persona: Tier 2 SOC Analyst
    • Persona: Tier 3 SOC Analyst
    • Persona: SOC Manager
    • Persona: Threat Hunter

Agent Workflow References:

  • Agent Workflow References

MCP Tools Integration:

  • Suggested New MCP Tools
  • SOAR MCP Tools Reference
  • SecOps MCP Tools Reference
  • SCC MCP Tools Reference

Development & Planning:

  • Project Plan: Enhance LLM Agent Context
  • Repository
  • Open issue

Index

By Your Name/Organization

© Copyright 2025, Your Name/Organization.