Procedures, not prose. Everything in this section is written to be executed — by you, at speed, possibly at 2 a.m., possibly by someone who isn't you.
A runbook is different from a chapter. A chapter explains why. A runbook assumes you already agreed and now need the steps in order, with the commands, and with the decision points marked so you don't have to re-derive them under pressure.
What makes one of these good¶
- Steps are numbered and ordered. If order doesn't matter, say so explicitly.
- Commands are copy-pasteable. Not
<your-cluster-here>where a real value is knowable. - Decision points are marked. "If X, go to step 7" beats a paragraph of nuance.
- It states its own preconditions. What access you need before you start, so you don't discover that at step 4.
- It has a date and a last-verified stamp. A runbook nobody has executed in eighteen months is a hypothesis.
- It says what "done" looks like. Incidents don't end because you ran out of steps.
Planned runbooks¶
| Runbook | When you reach for it |
|---|---|
| CVE Triage | The scanner produced 1,200 findings and you have an afternoon. How to get to the ones that matter without pretending you'll fix them all |
| Accepted Risk Register | Recording a decision not to fix, with a mandatory expiry so it comes back for review instead of becoming permanent by neglect |
| Reshaping CVE Alerts | Turning scanner output into something a human will actually read. Deduplication, suppression that expires, and why "critical" is not a priority |
| Supply Chain IoC Sweep | A package you run was compromised. Sweep a fleet for indicators, read-only, fast enough to run everywhere, honest about what it can't see |
| Emergency Credential Rotation | You have to assume a credential is gone. Scope, order, verification, and the ones people forget |
| Compromised Host Triage | Deciding between clean, isolate, and rebuild — and why the answer is usually rebuild |
Written the night after, not the night of
Every good runbook in my possession exists because something went badly and I wrote down what I wished I'd known. That's the honest provenance of the genre.
The corollary is that a runbook you copied from a blog post and never executed is decoration. Run it on a normal day. Find the step where the command doesn't work in your environment. Fix it then, not during.
The Supply Chain IoC Sweep runbook came out of exactly this — a real sweep across a homelab after a real compromise, including the part where the first version tried to find / on a box with network mounts and got killed by its own timeout.