## Playbook Design

A **Playbook** is the coded logic of a Standard Operating Procedure (SOP).

### Common Logic Blocks
1.  **Trigger**: New Phishing Alert.
2.  **Action**: Extract URL.
3.  **Enrichment**: Check URL reputation (VirusTotal).
4.  **Decision (Software)**:
    *   If VT Score > 5: **BLOCK** and Close Ticket.
    *   If VT Score < 5: Ask Analyst to review.

### Human-in-the-Loop
You don't automate *everything*. 
Critical decisions (e.g., "Shut down the CEO's laptop") should prompt a human for "Yes/No" approval via Slack/Email.