Blue Team Con 2026

The Human Centered Investigation Playbook (HCIP) standard is a YAML-based syntax for writing investigation playbooks that correspond to a particular alert, artifact, or attack. The goal is to have an investigation methodology that both guides the analyst and also integrates into defensive tooling to make necessary data easily available during the investigation. I will discuss the standard, explore its purpose and use cases, and demonstrate its functionality in a free and open monitoring platform