Overview#
When every team handles a recurring incident differently, response quality becomes inconsistent and compliance gaps emerge. Playbook Templates give organisations a standardised library of pre-built response procedures, each with customisable workflow steps, escalation paths, and role assignments, so teams follow the same proven process every time regardless of which shift is on duty.
Key Features#
- Pre-built response playbook templates for common operational scenarios
- Customisable workflow steps and escalation procedures
- Template versioning and change tracking
- Role-based template assignment and access control
- Integration with case management and alert systems
Use Cases#
Relevant sectors include law enforcement, critical infrastructure, and defence.
- Standardising incident response procedures across distributed teams
- Ensuring consistent handling of recurring operational scenarios
- Accelerating response times through pre-defined action sequences
- Maintaining compliance with operational procedure requirements
Integration#
Integrates with case management, alert systems, and workflow automation modules for end-to-end incident response coordination.
Open Standards#
- CACAO (Collaborative Automated Course of Action Operations, OASIS): Pre-built playbook templates in the library are explicitly aligned to the CACAO standard, structuring response workflows as machine-readable, shareable course-of-action playbooks with trigger, enrich, condition, escalate, and close step types.
- GraphQL (June 2018 Specification): All playbook template operations, creation, versioning, execution, sharing, and analytics, are exposed through a typed GraphQL API built on the Strawberry framework, covering 20-plus queries and mutations.
- JSON Schema: Each step type in the extensible registry declares a
config_schemain JSON Schema format, enabling structured validation of per-step configuration stored as JSONB in the database. - ISO 17442 (Legal Entity Identifier): Playbooks that perform corporate or beneficial ownership investigation query and synchronise records from the GLEIF LEI registry, resolving entities against the globally standardised 20-character LEI code.
- RFC 3339 / ISO 8601: All execution state transitions, audit events, and step timestamps are recorded and exchanged in RFC 3339 date-time format, ensuring interoperability across the execution engine, audit trail, and downstream consumers.
- SHA-256 (FIPS 180-4): The playbook execution audit trail uses SHA-256 to hash each audit event and chain it to its predecessor, producing a tamper-evident, court-admissible execution history.
- ISO 3166-1 alpha-2: Geographic enrichment steps within playbooks identify jurisdictions using ISO 3166-1 alpha-2 country codes, enabling consistent cross-border risk scoring and sanctions-list lookups.
- OAuth 2.0 (RFC 6749): Role-based access control for playbook creation, execution, sharing, and template forking is enforced via OAuth 2.0-backed authentication, with permission checks applied to every query and mutation.
Last Reviewed: 2026-02-24 Last Updated: 2026-04-14