Security Playbooks is a defensive cybersecurity and blue team repository designed for cybersecurity professionals, SOC analysts, threat hunters, detection engineers, incident responders, and security practitioners.
It focuses on delivering realistic, MITRE ATT&CK mapping, detection engineering, detection rules, detection validation, threat hunting, incident response playbooks, security playbooks, SOC workflows, adversary emulation, threat intelligence, IOC enrichment, security validation, automated testing, security automation, security integrations, coverage analysis, and hands-on labs to help users build practical skills in threat hunting, incident response, detection engineering, and adversary simulation within controlled environments.
The project aims to bridge the gap between the oretical knowledge and real-world security operations by providing structured, reproducible, practical cybersecurity workflows, threat intelligence, detection engineering, incident response, security validation, automated testing, machine-readable security content, and coverage analysis capabilities.
- Alert Investigation & Triage
- Threat Hunting Operations
- Detection Engineering & Validation
- Incident Response Simulation
- Adversary Emulation (Lab Only)
- Training & Skill Development
This Security Playbooks repository is intended strictly for educational, research, and authorized security testing purposes only.
Users are solely responsible for ensuring their activities comply with all applicable laws and regulations.
The maintainers assume no liability for misuse or any damages resulting from the use of this project.
The contents of this repository, including scripts, scenarios, and detection rules, are provided for educational, research purposes only. No responsibility for any damage, misuse, or legal consequences resulting from the use of this material.
This software is provided “as is” without warranty of any kind, express or implied.
- SOC Analysts
- Threat Hunters
- Blue Team Engineers
- Cybersecurity professionals
- Red Teamers (Lab Use Only)
- Detection Engineers
- Threat Intelligence Analysts
- Detection Rules
- Attack Scenarios
- Hands-on Labs
- Log Analysis Examples
- Documentation & Tools
- Sigma, YARA & Suricata Rules
- IOC Enrichment & Threat Feeds
Coverage mappings are maintained in:
- Mitre Mapping – MITRE ATT&CK techniques mapping
- Coverage Matrix – Detection coverage matrix
- Coverage Report – Detection coverage summary and analysis
- Attack Navigator Layer — ATT&CK Navigator layer
- Rule Coverage Map — Rule-to-technique coverage mapping
Security Playbooks includes integrations for common security platforms and collaboration tools:
- Microsoft Defender
- CrowdStrike Falcon
- Microsoft Sentinel
- Splunk
- Elastic
- Slack
See Integrations for implementation details.
This workflow shows how security behaviors are mapped, detected, investigated, enriched, validated, tested, and measured across the repository.
Threat / Attack Behavior
↓
MITRE ATT&CK
↓
Detection Rules (Sigma / YARA / Suricata)
↓
Alert / Event
↓
Triage
↓
Investigation
↓
Threat Hunting
↓
IOC / Threat Intelligence
↓
Incident Response
↓
Validation
↓
Automated Tests
↓
Coverage / Reporting
- Linux — Recommended for development, testing, automation, and deployment
- Windows — Supported for development and testing with Visual Studio Code and WSL2
- macOS — Supported for local development and testing
- Python 3.11+
- pip for Python dependency installation
- Make for repository automation and common development tasks
- Git for repository management
- PyYAML for YAML configuration and metadata processing
- JSON support for schemas, datasets, reports, and machine-readable security data
- Sigma rule support
- YARA rule support
- Suricata rule support
- pytest for automated testing and validation
- Docker: Used for containerized labs, testing, and integration workflows
- Scapy: Used for generating and working with Suricata PCAP fixtures
# Clone repository
git clone https://github.com/secwexen/security-playbooks.git
cd security-playbooks
# Create virtual environment
python -m venv venv
source venv/bin/activate # Linux/Mac
venv\Scripts\activate # Windows
# Install dependencies
pip install -r requirements.txt
# Install dev dependencies
pip install -r requirements-dev.txt
# Run the full pytest suite
python -m pytest -vFor full details, refer to the Quick Start file.
The project includes automated tests for YARA and Suricata detection rules.
# Run Sigma detection tests
python -m scripts.run_sigma_tests
# Run YARA tests
python -m scripts.run_yara_tests
# Run Suricata tests
python -m scripts.run_suricata_testsThe Suricata fixtures are real PCAP files generated with Scapy. Scapy is included in Development Requirements.
If the PCAP fixtures need to be regenerated:
python tests/suricata/generate_fixtures.pyFor complete setup instructions and troubleshooting, see the Quick Start guide.
Copyright © 2026 secwexen.
This project is licensed under the MIT License.
See the LICENSE file for full details.
Contributions and suggestions are welcome!
- Fork the repository and create a feature or fix branch (e.g.
feature/your-feature,fix/bug-name,docs/update-readme,chore/dependency-update). - Make your changes and update the relevant documentation, playbooks, or detection rules as needed.
- Use clear commit messages (e.g. Conventional Commits:
feat:,fix:,docs:,refactor:). - Open a pull request referencing related issues/discussion when possible.
- All PRs must pass CI checks before merging.
Please open an issue before submitting major changes or new features.
See CONTRIBUTING for detailed contribution guidelines.
Planned improvements include:
- Expanded ATT&CK-mapped playbooks and lab scenarios
- Enhanced and validated detection rules (Sigma, YARA, and Suricata)
- Structured SOC workflows and incident response playbooks
- Standardized, machine-readable playbook formats
- Alignment with security frameworks (NIST, CIS, ISO)
For the full roadmap and upcoming features, see ROADMAP.
If you discover a security vulnerability, please follow our responsible disclosure process.
See SECURITY for detailed information.