Demisto pays for your Playbooks!

Demisto believes that the best way to secure organizations is by collaborating and sharing information.

One of the ways to reach this goal is to build a comprehensive, open and shareable DFIR playbook library.

We believe that this will  benefit the community greatly, and we invite you to join this effort.


If you have technical knowledge and  would like to share a playbook that you have created, our team will help with adopting and publishing it.

By submitting a playbook you will both, contribute your knowledge to the DFIR community, and make up to $500.

What we are looking for:

  1. Technical expertise in the incident response domain
  2. A well written playbook
  3. Clear explanation about each step in the playbook
  4. At least 1000 words to describe the playbook in a word document

Playbook examples that you can offer:

  1. Lost/stolen laptop
  2. Malware outbreak
  3. Ransomware
  4. PII (sensitive data) loss
  5. Insider threat incident
  6. Any other playbook used for incident response

Look at our current playbook articles at:


You can get paid by either PayPal or Amazon gift card.


The amount will be calculated based on:

  1. For in depth playbook text, of 1000+ words that is approved by our referees – 300$
  2. The Demisto platform provides a drag and drop tool for visual playbook representation, for translating the textual tutorial (see above) to the COPS standard you will be paid an additional 200$ (total of 500$), this will be published at our open source playbook repo (Playbooks).


What you need to do:

First step:

Send to the following info:

  1. Name
  2. Association (if you want it included with the credits)
  3. Your resume (can be LinkedIn link) and if you have, some pervious writing samples
  4. Which Playbook you will want to submit, short overview (2-3 lines will do)

We will review this and either give you a green light (approval number)  or other feedback. Once approved you can start working on the playbook article(please thoroughly proofread before submission).
Upon submission (with the approval number) we will review and either request changes or update you that the playbook is ready. We will then publish it in the textual playbook section and/or in the COPS section and will credit you as well as send you your reward..

For any questions, feel free to contact us by email ( or at our DFIR slack community( on the #playbooks channel.