A security playbook is designed to help analysts answer fundamental questions: How big is the problem, and who was involved? An SOC with a playbook has the advantage of being able to focus only on the alerts that matter. Without playbooks, analysts tend to revert to their gut which might be effective for the individual, but it leaves the entire team at the mercy of the knowledge that exists within that analysts mind. Playbooks should include the types of threats that have been seen in previous occurrences.”]
Source: https://securityintelligence.com/does-your-soc-have-a-security-playbook/