The zero budget SOC. Using git, markdown and plain text to stop overthinking playbooks

One of the biggest challenges facing any Security Operations Centre (SOC) is the loss of institutional knowledge. What happens when senior engineers are unavailable during a crisis, or leave the organisation altogether? How is a new junior hire expected to operate on a day-to-day basis without constant guidance from senior staff?

Too often, critical procedures exist only in the heads of a few people. Junior analysts are left relying on ad-hoc questions to fill the gaps, while official documentation sits in SharePoint sites and file shares, ignored and outdated long before a real incident hits.

We’re all under pressure to automate and do more with tighter budgets. Buying yet another platform to "solve" documentation isn't always the answer. In fact, the best solution in completely FREE.

This talk explores adopting a GitOps approach and moving SOC playbooks into plain text and Markdown and storing them in a Git repository. By treating our procedures like code, we make them version-controlled, searchable from the terminal, and actually maintainable. This lowers the barrier for new hires, preserves what your veterans know, and builds a resilient SOC without the "premium tool" price tag.