Think about what a playbook does when a security alert is triggered automatically by a system.
Consider which actions directly address the three aspects of incident response: detection, containment, and recovery.
Evaluate which actions a playbook can reliably execute without human judgment or external dependencies like courts.
A phishing playbook both directs responder actions and automates routine handling steps.
Two answers should describe guiding response and automating repetitive work.
Avoid choices that suggest the playbook investigates without human involvement or replaces evidence handling.

The importance of evidence preservation