Opening: Where your team spends the clock

• To start, how many full-time analysts staff your SOC and how are shifts organized? Options: 1-3 analysts, 4-7 analysts, 8-12 analysts, 13-20 analysts, 21+ analysts
• Tell me about your typical daily alert volume and the three alert categories that appear most often. Options: Phishing reports, Endpoint detections, Network anomalies, Suspicious logins, Vulnerability alerts, Other
• Walk me through the most recent incident that required the longest containment time, including the manual steps analysts performed to investigate.
• On an average shift, roughly what share of analyst time is spent copying indicators between consoles versus making containment decisions? Options: <20%, 20-40%, 40-60%, 60-80%, >80%
• Which categories of consoles or tools are you most often copying data between during triage? Options: SIEM / log console, EDR / endpoint console, Email gateway, Threat intel feed, Identity provider, Ticketing system, On-prem legacy system, Other
• Estimate how many recent incidents from the last 30 days would be suitable for building a playbook for testing. Options: 0-2, 3-5, 6-10, 11-20, 21+
• If automation could reduce average triage time from your current baseline to under two minutes for those incidents, provide your best estimate of reclaimed analyst hours per week.

Where delays translate into measurable risk

• If a delayed containment event cost you eight hours last quarter, quantify the business impacts that stemmed directly from that delay. Options: Operational disruption, Customer impact, Regulatory exposure, Escalated executive attention, No measurable impact, Other
• Describe the most common failure that occurs when manual triage is rushed, and the downstream work it creates.
• How often do duplicated investigations or missed indicators occur because analysts lack a single source of shared context, measured in a typical month? Options: Almost every day, Weekly, A few times a month, Rarely, Unknown
• Name the one operational failure related to triage that, if it happened during a pilot, would immediately stop the program.
• When containment is delayed, which compliance or SLA exposure is most likely to be triggered within 30 days? Options: Data loss notification requirement, Service availability SLA breach, Incident reporting to regulators, Customer breach notification, No SLA at risk, Other

The manual steps that eat your time

• Assuming current manual processes stay in place, how long until alert backlog or overtime becomes a sustained cost for the team? Options: Already sustained, Within 1 month, 1-3 months, 3-6 months, No immediate risk
• List the exact manual actions a triage analyst performs on a high-volume phishing report, in order.
• On average for a single case, count the number of distinct consoles or endpoints an analyst must query. Options: 1-2, 3-4, 5-6, 7-10, 10+
• Do any of those systems require credentialed access behind a VPN, jump host, or on-prem access that complicates automated connections? Options: Yes, several do, Yes, a few do, No, most are cloud accessible, Unknown
• Name the role that is responsible for escalating when manual isolation or containment is delayed, and capture the escalation SLA.
• Outline the typical cleanup work or operational cost when an IOC is copied incorrectly during manual triage.

What automation must prove to earn trust

• If a single automated action led to an incorrect isolation during the pilot, would that outcome stop you from advancing to active automation? Options: Yes, stop immediately, Pause and investigate, Continue with additional safeguards, Depends on impact
• List the safety constraints you require before a playbook can take an action without analyst approval. Options: Advisory mode by default, Multi-analyst confirm, Rollback capability, Time-limited actions, Read-only operations, Other
• How do you measure acceptable timing, false positive tolerance, and rollback windows for a successful pilot?
• Specify the acceptance criteria you would use to judge functional correctness and timing, including any numeric thresholds.
• Are there mandatory boards, legal reviews, or policy signoffs that must approve automated response actions before they can be promoted from advisory to active? Options: Change advisory board, Legal/compliance review, Security architecture review, No formal signoff required, Unknown

Who must buy in and who can stop this

• Name the single approver whose veto would pause rollout, include their role and the reason their approval is decisive.
• Please identify the budget owner and the approval process for purchasing platform licenses and ongoing costs.
• Estimate the number of SOC users and distinct roles that will need access during the pilot and ongoing operations. Options: 1-5 users, 6-15 users, 16-30 users, 31-50 users, 50+ users
• If the pilot meets acceptance criteria, describe the expected approval timeline and the next administrative step you would take. Options: Sign contract within 1 week, Procurement in 2-4 weeks, Quarterly budgeting delay, Dependent on executive review
• Are network, endpoint, and identity teams able to commit on-call time or access windows needed for playbook execution during the pilot? Options: Yes, fully committed, Partially available, Not available currently, Unknown

Operational readiness and integration gates

• If a required integration lacks a stable API or available credentials, will that tool block the pilot or can you test a reduced scope? Options: Block the pilot, Allow reduced scope, Replace with alternative data source, Unknown
• Select which system categories must integrate for the pilot, pick all that apply. Options: SIEM / log platform, EDR / endpoint platform, Email gateway, Identity provider, Ticketing system, Threat intelligence feed, On-prem legacy system, Firewall / network appliance
• For the categories you selected, identify who owns the API credentials and can grant access during the pilot, by role.
• Do any systems require on-prem agents, air-gapped access, or third-party vendor approvals to connect for testing? Options: Yes, on-prem agents required, Yes, vendor approvals needed, No special requirements, Unknown
• Are there contractual, data residency, or compliance constraints that would prevent the export, enrichment, or automated action on relevant telemetry? Options: Yes, prevents certain exports, Yes, requires review but allowed, No constraints, Unknown
• State your target timeline to have test environments, credentials, allowlists, and incident samples ready for an initial build. Options: <1 week, 1-2 weeks, 3-4 weeks, >4 weeks
• If those readiness items cannot be met within 4 weeks, will the organization pause the pilot or proceed with an adjusted plan? Options: Pause the pilot, Proceed with adjusted plan, Extend timeline, Decision pending

The alternatives you are weighing

• Describe the specific outcome that would make you keep your current approach rather than switching to an external automation platform.
• Select the alternatives you are actively evaluating or considering for automation and orchestration. Options: Incumbent vendor orchestration, Another third-party SOAR, In-house scripts and automation, Managed detection and response provider, Do nothing, Open source automation, Other
• Has anyone proposed building equivalent playbooks internally, and if yes, estimate the headcount and months required to reach parity. Options: No internal proposal, Yes, 1-2 people for 1-3 months, Yes, 3-5 people for 3-6 months, Yes, larger team and timeline, Unknown
• If you stayed with your current vendor, identify the single capability they would need to add to keep your business.
• Identify the one option most likely to win this procurement and the specific reason it would be chosen.

Decision rules, acceptance criteria, and financial thresholds

• If the two pilot playbooks meet your timing and correctness goals on two live incidents, what is the single action you will take that week? Options: Approve rollout, Request expanded pilot, Escalate to procurement, Defer decision
• Pick up to three acceptance criteria that are most important for pilot success. Options: Time-to-complete under 2 minutes, Functional correctness on live incidents, Advisory-mode safety behavior, Rollback within 30 minutes, Audit trail and explainability, Analyst hours reclaimed per week, Minimal configuration overhead
• Provide the minimum quantitative target for reclaimed analyst hours per week that would justify purchase in your view. Options: <10 hours, 10-25 hours, 26-50 hours, 51-100 hours, 100+ hours
• State the single financial metric your budget owner will use to approve spend, for example annual cost saved or hours recovered.
• If the pilot misses the top acceptance criterion, do you want to iterate with adjusted scope or stop and revisit later? Options: Iterate with adjustments, Stop and revisit later, Escalate requirement change, Undecided
• Select the level of access playbooks will require during the pilot. Options: Read-only enrichment, Advisory-write (actions suggested), Full active change (isolations, disables), Mixed levels per playbook

Next practical steps and timeline

• If committing a named pilot owner would accelerate decision by one week, would you assign someone now? Options: Yes, we can assign now, We can assign after internal alignment, No, not possible, Need more information
• Provide target dates for pilot start, selection of two incidents to test, and a two-week evaluation window.
• Name the day-to-day contact for the seller during build and test, include role and preferred contact method.
• List any blockers that must be resolved in the next two weeks to keep the proposed schedule.
• If the team cannot commit the required pilot resources within the timeline provided, should we pause scheduling or proceed with a reduced scope? Options: Pause scheduling, Proceed with reduced scope, Extend timeline, Decide after root-cause fix

• Provision platform tenant and admin access
• Integrate SIEM via API connector
• Integrate endpoint detection & response (EDR)
• Integrate email security and phishing report ingest
• Integrate ticketing and ITSM systems
• Connect legacy on‑prem systems via bridge connector
• Develop phishing triage playbook
• Develop endpoint isolation playbook
• Automate indicator enrichment and reputation lookups
• Configure parallel API execution and throttling
• Enable advisory mode with response safeguards
• Deploy playbook test harness and incident replay
• Instrument execution timing and ROI metrics

Provision platform tenant and admin access

• Do you require a dedicated tenant or a shared evaluation tenant for this engagement? Options: Dedicated tenant, Shared evaluation tenant, Unsure
• Name the role that will be the primary admin for the tenant. Options: SOC Manager, Infrastructure Engineer, Security Architect, Other
• Provide the list of admin onboarding documents you can supply (SOPs, change control, network diagrams).
• Which authentication method will you use for admin console access (single sign-on, local credentials, OAuth2)? Options: Single sign-on (SAML/SCIM), Local credentials, OAuth2, Other
• Are there IP allowlist constraints or bastion requirements for administrative console access? Options: Yes, No
• How many administrator accounts need provisioning for initial rollout? Options: 1-2, 3-5, 6+

Integrate SIEM via API connector

• Which SIEM export surface will we use for alert ingestion (event API, search API, syslog export)? Options: Event API, Search API, Syslog export, Other
• What is the SIEM alert retention window available for replay and validation in days? Options: 7 days, 30 days, 90 days, Custom
• Share an example SIEM alert ID and the schema field you use for priority mapping.
• Does the SIEM require certificate pinning or mutual TLS for API access? Options: Yes, No
• Describe the SIEM API rate-limit, pagination behavior, or webhook retry semantics we should plan for.
• Identify the team that will supply SIEM API credentials and approve access. Options: Security Ops, Platform/Infrastructure, Third-party MSP, Other

Integrate endpoint detection & response (EDR)

• Which endpoint detection and response (EDR) actions must be callable from playbooks (isolate host, kill process, collect artifacts)? Options: Isolate host, Kill process, Collect artifact, Query process tree, Other
• List the EDR agent versions and operating system images in scope for automated actions.
• Do you permit automated host isolation from playbooks or require human approval per runbook? Options: Fully automated allowed, Require human approval, Advisory mode only
• Specify the acceptable false-positive threshold for isolation actions used to gate automation. Options: <0.1%, <1%, <5%, Custom
• Name any network segments, VLANs, or OT host groups that must be exempt from isolation actions.
• Name the owner responsible for rotating and maintaining EDR API keys. Options: Security Ops, Platform team, Managed Service, Other

Integrate email security and phishing report ingest

• Identify the inbound source that carries user-reported phishing in your environment (shared mailbox, phishing portal, ticketing). Options: Shared mailbox, Phishing report portal, Ticketing ingest, Other
• Which email headers or fields do you rely on to classify phishing incidents (message-id, Received chain, SPF/DKIM verdict)?
• Will you allow playbooks to perform automated sender disable or mailbox quarantine as part of triage? Options: Yes, No, Only advisory
• What was the average daily volume of user-reported phishing items in the last 30 days? Options: <10, 10-100, 100-500, 500+
• Which attachment handling policy should the playbook follow for detonation, quarantine, or analyst review? Options: Detonate in sandbox, Quarantine attachment, Notify analysts only, Other
• Identify the owner of email security API credentials and mailbox access approvals. Options: Email admin, Security Ops, IT Helpdesk, Other

Integrate ticketing and ITSM systems

• Which IT service management (ITSM) surface will be used for case creation and updates? Options: Create incident via API, Update existing tickets, Comment-only integration, Other
• Which ticket fields should map to SOC triage status such as severity, owner, and SLA?
• Do you require bi-directional synchronization between playbook state and the ticketing system? Options: Yes, No
• What ticket SLA thresholds must playbooks respect before auto-closure or escalation? Options: 24 Hours, 48 Hours, Custom
• Name the approver role authorized to approve automatic ticket updates from playbooks. Options: SOC Manager, Incident Commander, Automation Engineer, Other
• Provide the ticketing API authentication method available (API key, OAuth2, basic auth). Options: API key, OAuth2, Basic auth, Other

Connect legacy on‑prem systems via bridge connector

• Which legacy on‑prem endpoints require bridging (firewall console, legacy SIEM, air-gapped EDR, management servers)?
• Describe the network path available for the bridge connector (outbound-only, VPN, jump host). Options: Outbound-only, Site-to-site VPN, Jump host/proxy, Other
• Are there approved change-control or maintenance windows required to install a bridge connector appliance? Options: Yes, No
• List the protocols the bridge must support to reach legacy consoles (SSH, RPC, SMB, JDBC). Options: SSH, RPC, SMB, JDBC, Other
• Does the legacy system require agent-based access, API-only access, or database-level connectivity? Options: Agent required, API available, Database access only, Other
• Which team will provide firewall rule approvals and network changes for the bridge connector? Options: Network team, Security Ops, Infrastructure, Other

Develop phishing triage playbook

• Which phishing triage steps from your runbook should the playbook automate (URL reputation, attachment detonation, mailbox quarantine, user notification)? Options: URL reputation, Attachment detonation, Mailbox quarantine, Disable sender, User notification, Other
• Supply an example phishing incident ID from the last 30 days that we should use for test replay and validation.
• What performance target do you require for automation versus manual triage in seconds per case? Options: <8 seconds, <30 seconds, <2 minutes, Custom
• List the data enrichment sources the playbook must call (threat intelligence feed, URL scanner, DNS logs, internal reputation).
• Which safety checkpoints should require human approval in advisory mode (account disable, host isolate, auto-delete messages)? Options: Account disable, Host isolate, Auto-delete messages, No checkpoints, Other
• Define the acceptance criteria for the phishing triage playbook including required functional tests, allowable false positive thresholds, and maximum completion time.

Develop endpoint isolation playbook

• Which initial indicators should trigger the endpoint isolation playbook (EDR alert patterns, SIEM correlation rule ID, IOC match)?
• Specify the exact isolation action required from the playbook (network block at host, disable user account, revoke VPN token). Options: Block network at host, Disable user account, Revoke VPN token, Other
• Which escalation path and on-call rotation should the playbook notify when isolation actions are taken?
• What minimum corroborating evidence threshold must be met before isolation (EDR confidence score, SIEM correlation, multi-sensor match)? Options: EDR confidence >90%, EDR + SIEM correlation, Analyst confirmation required, Other
• Identify any whitelisted hosts or host groups (OT controllers, management servers) that must be exempt from isolation.
• How will you validate acceptance for endpoint isolation (test incidents, rollback window, acceptable false isolation rate)?

Automate indicator enrichment and reputation lookups

• Which indicator types should be enriched by automation (IP, domain, URL, file hash)? Options: IP, Domain, URL, File hash
• List the external feeds or internal threat intelligence sources you require for enrichment.
• What maximum enrichment latency per call is acceptable to meet your SLA for triage workflows? Options: <1s, <5s, <30s, Custom
• How should the system reconcile conflicting reputation results (most recent, highest severity, require analyst review)? Options: Most recent, Highest severity, Analyst review, Custom
• Does enrichment require rate-limiting, batching, or caching to avoid upstream API throttling? Options: Yes, No
• Name the owner responsible for mapping feed fields to your SIEM or endpoint detection and response (EDR) schema. Options: Security Ops, Integration Engineer, Data Team, Other

Configure parallel API execution and throttling

• What parallel execution limits does your environment permit per integration (concurrent API calls)? Options: Low (1-5), Medium (6-20), High (21+)
• List any integrations that have strict API quotas or burst limits requiring special throttling.
• Which playbook steps must remain serialized for safety even when other steps run in parallel (account disable, host isolate)?
• Which backoff strategy should be used on API 429 rate-limit responses (exponential, fixed delay, queue)? Options: Exponential backoff, Fixed delay, Queue and retry, Other
• What monitoring metrics should alert for throttling events (error rate, latency, retry count)? Options: Error rate, Latency, Retry count, Other
• Name the team responsible for updating integration throttle settings if APIs change. Options: Integration owner, Security Ops, Platform team, Other

• decision_readiness
• current_state
• gaps
• stakeholders
• desired_state
• success_criteria
• desired_state
• success_criteria
• stakeholders
• gaps
• current_state
• decision_readiness
• stakeholders
• decision_readiness
• current_state
• decision_readiness
• decision_readiness
• decision_readiness
• decision_readiness

• Subscription Agreement (Order Form)
• Master Services Agreement (MSA)
• Statement of Work (SOW)
• Service Level Agreement (SLA)
• Data Processing Addendum (DPA)
• Access & Credentials Authorization
• Acceptance Criteria and Go/No-Go Signoff
• Change Order Agreement

• Go-live Health Check (Week 1-4)
• First Measurement Review (Week 4-10)
• Acceptance Gate Review (Day ~90)
• Quarterly Success Review (Ongoing)

• Initiate a safety audit for any playbook that caused reopened cases and schedule remediation work.
• Produce a clear pass or fail verdict for each numeric acceptance criterion recorded in Hands-On Evaluation.
• Capture a documented go or no-go decision by the buying owner and publish it to the shared workspace.
• Define remediation tasks and timelines for any failed criteria so the loop is closed within the agreed remediation window.
• Publish the acceptance decision record showing pass/fail per criterion and the buying owner's documented decision.
• Log remediation tasks for failed criteria with acceptance tests and completion dates.
• Schedule a verification checkpoint after remediation completion to re-measure the affected metrics.
• Trend review for reclaimed hours and playbook success rate
• Confirm the solution continues to meet weekly reclaimed hours and playbook success rate expectations relative to targets in Hands-On Evaluation, or document corrective plans.
• Close or move forward the top enhancement requests and safety remediations for the next quarter.
• Determine whether to keep the quarterly cadence or add monthly operational check-ins for faster blocker burn-down.
• Publish the quarterly realization dashboard showing reclaimed hours and playbook success rate trends with annotated incidents.
• Prioritize and schedule the top 3 enhancement requests or fixes for the upcoming quarter with acceptance tests.
• Reconfirm acceptance criteria and owners
• Confirm the prioritized playbooks are executable in advisory mode with integrations reporting telemetry.
• Create a visible list of open blockers with owners and resolution target dates.
• Confirm who will publish the first measurement data feed for the next review.
• Publish a deployment verification checklist showing connector status, environment access, and advisory-mode telemetry availability.
• Log and assign remediation tasks for critical blockers with expected resolution dates.
• Enable or verify monitoring that will capture playbook run counts and basic success/failure flags for the first measurement.
• Present first measurement data
• Determine whether hours reclaimed per week and median playbook time-to-complete meet the numeric targets recorded in Hands-On Evaluation.
• Document root causes for any metric shortfalls and agree concrete remediation tasks and dates.
• Confirm the data sources and report schedule that will feed the Acceptance Gate meeting.
• Export and publish the playbook run dataset that produces the hours-reclaimed and time-to-complete metrics for audit.
• Implement agreed playbook changes or connector fixes and schedule verification runs in advisory mode.
• Produce an updated timeline to the acceptance gate showing remediation completion and validation steps.
• Restate acceptance criteria and numeric targets
• Deployment and connector validation
• Present outcome data against each criterion
• Safety incidents and reopened case review
• Diagnose gaps and root causes
• Enhancement requests triage and prioritization
• Agree corrective actions and owners
• Early adoption signals and usage patterns
• Document pass or fail per criterion and record decision
• Confirm readiness timeline to acceptance gate
• Agree remediation plan for any failed criteria
• Open issues and next quarter objectives
• Blockers, defects, and open items
• Agree immediate remediation actions