🚨 ir-playbook-gen

AI-powered Incident Response Playbook Generator. Specify an incident type, sector, and regulatory framework — get a complete, structured IR playbook in markdown with containment steps, forensic checklists, RACI roles, comms templates, and regulatory notification timelines.

Part of a GRC automation toolkit alongside control-crosswalk and grc-gap-ai.

---

Why this exists

Writing an IR playbook from scratch takes hours and is often skipped until after an incident. This tool generates a complete, tailored playbook in under 60 seconds — ready to adapt, store in your runbooks, and hand to your IR team.

---

Quick start

git clone https://github.com/workmcg/ir-playbook-gen
cd ir-playbook-gen
pip install -r requirements.txt

# Generate a ransomware playbook (NIS2, general sector)
python ir_playbook.py --type ransomware

# Tailor for healthcare under GDPR
python ir_playbook.py --type "data breach" --sector healthcare --framework GDPR

# Save to a specific file
python ir_playbook.py --type "insider threat" --output playbooks/insider_threat.md

# List all supported incident types
python ir_playbook.py --list

# Preview the prompt without calling the API (no key needed, no file written)
python ir_playbook.py --type "zero-day exploit" --framework DORA --dry-run

# Generate a playbook for every supported incident type in one run
# (saves to playbooks/ by default; --output can point elsewhere)
python ir_playbook.py --all --sector healthcare --framework GDPR

Set your API key as an environment variable to skip the prompt:

export OPENAI_API_KEY=sk-...   # macOS/Linux
set OPENAI_API_KEY=sk-...      # Windows

Run the test suite (mocks the OpenAI client — no API key or network needed):

pip install pytest
pytest tests/

---

Supported incident types

Incident Type	Common frameworks
Ransomware	NIS2, DORA, ISO 27001
Data breach	GDPR, NIS2, ISO 27001
Insider threat	ISO 27001, NIST CSF
DDoS	NIS2, DORA
Supply chain compromise	NIS2, DORA, ISO 27001
Phishing campaign	ISO 27001, NIST CSF
Business email compromise	ISO 27001, NIST CSF
Cloud misconfiguration	ISO 27001, NIST CSF
Credential stuffing	NIS2, GDPR
Zero-day exploit	NIS2, DORA

Any free-text incident type works too.

---

What's in each playbook

Every generated playbook contains:

• Overview — incident description, business impact, attack vectors
• Detection & Triage — IoCs, SIEM queries, severity classification
• Roles & Responsibilities — RACI-style table for IR team
• Containment — numbered, actionable steps for the first 4 hours
• Investigation — evidence checklist (volatile-first), forensic artefacts, key questions
• Eradication — complete removal steps and validation checks
• Recovery — restoration sequence and return-to-normal criteria
• Communications — three ready-to-use templates (internal, board, regulatory)
• Post-Incident Review — PIR agenda, lessons-learned questions, MTTD/MTTR metrics
• Regulatory Obligations — notification timelines, content requirements, authority contacts
• Quick Reference Card — one-page summary for the on-call team

---

Example output

See examples/ransomware_nis2.md for a complete generated playbook.

---

Architecture

ir_playbook.py
│
├── argparse CLI  ─── --type, --sector, --framework, --output, --list, --all, --dry-run
│
├── Prompt builder ── tailors system + user prompt to incident/sector/framework
│
└── OpenAI GPT-4o ─── temperature 0.2 for consistent, structured output
                       → markdown playbook → saved to file

---

Roadmap

Shipped

• Batch generation — generate all incident types at once (--all)

Up next

• Local model support (Ollama) for air-gapped environments
• DOCX export (audit-ready Word format)
• DORA-specific playbooks (ICT incident classification tiers)
• Confluence / Notion export via API

---

Related tools

• control-crosswalk — map controls across ISO 27001, NIST CSF, NIS2
• grc-gap-ai — AI-powered compliance gap analysis

---

License

MIT