Looking for a playbook on how to respond to a security breach? 

Once it's already happened is too late; you need to know "how to put out the fire" in advance. 

With that in hand, you'll be able to address known threats, but what about ones you've never encountered? In this video, Jeff "The Security Guy" explains the need to have a strategy AND the right tools for handling security incidents, including so-called "black swan" events. That's the purpose of a SOAR system (Security, Orchestration, Automation & Response) - it's an incident tracking and orchestration system that automates tasks that can be automated and helps manage the human effort for those tasks that can't be automated.