Using Playbooks
Load a methodology checklist onto an engagement and work through it.
Using Playbooks
A playbook is a methodology checklist. Load one onto an engagement and work through it task by task, so nothing gets missed.
What playbooks are for
Pentests follow methodologies. PTES, OWASP WSTG, NIST 800-115, MITRE ATT&CK. Each defines a set of steps that should be performed in order.
A playbook turns a methodology into a live checklist attached to a specific engagement. Every task is tracked. Progress is visible. Notes are attached.
Available playbooks
ATHELOS ships with fourteen playbooks:
| Playbook | Framework |
|---|---|
| PTES Overview | Penetration Testing Execution Standard |
| OWASP WSTG | Web Security Testing Guide |
| OWASP MASTG | Mobile Application Security Testing Guide |
| OWASP API Top 10 | API Security |
| NIST SP 800-115 | Technical Guide to Information Security Testing |
| MITRE ATT&CK Reference | Adversary Tactics and Techniques |
| AD Attack Playbook | Active Directory |
| Network Pentest Playbook | Internal and external networks |
| Cloud Security Playbook | AWS, Azure, GCP |
| Wireless Security Playbook | WPA2, WPA3, rogue APs |
| Social Engineering Playbook | Phishing, vishing, pretexting |
| Digital Forensics Playbook | Disk, memory, and network forensics |
| Incident Response Playbook | NIST 800-61 lifecycle |
| Threat Hunting Playbook | Hypothesis-driven hunting |
Each playbook has between four and twelve phases, with tasks, tools, evidence templates, and references.
Loading a playbook
From an engagement, open the Playbooks tab. Click Load playbook.
A dialog appears with the full list. Pick one and click Load.
The playbook is now attached to the engagement. Progress starts at zero.
Working through tasks
Click into the loaded playbook. You'll see its phases, each with their tasks.
For each task you have three actions:
- Check the box when the task is complete
- Click the note icon to add free-text notes to the task
- Click the paperclip to attach a finding or evidence file
Progress updates automatically. The playbook shows:
- Per-phase progress bars
- Overall completion percentage
- Task counts per phase
Notes on tasks
Notes are free-text. Use them to record:
- What you actually did
- Command output
- Observations that don't rise to the level of a finding
- Reminders for the report
Notes are per-task. They don't appear in the report automatically, but you can copy them into the executive summary or methodology section.
Attaching findings and evidence
Click the paperclip on a task to attach:
- Findings — link an existing finding to this task
- Evidence — attach an evidence file to this task
This creates a bidirectional link:
- From the task, you see the attached finding or evidence
- From the finding, you see which playbook tasks it relates to
Useful for showing clients "this finding came from this step of the methodology."
Detaching
To detach a finding or evidence from a task, open the attachment and click Detach. The attachment stays on the finding — only the link from the task is removed.
Loading multiple playbooks
An engagement can have more than one playbook. For example:
- Load PTES for the overall methodology
- Load AD Attack Playbook for the Active Directory portion
- Load Cloud Security Playbook for the AWS portion
Each runs independently. Progress is tracked per playbook.
Cross-engagement playbook view
The Playbooks section in the main sidebar shows every playbook loaded across every active engagement. This is a dashboard view:
- Which engagements have playbooks loaded
- How far along each is
- Which playbooks are used most often
Useful for a quick snapshot of where you stand across all your work.
Removing a playbook
To remove a playbook from an engagement, open it and use the menu at the top-right. Click Remove playbook.
You'll be asked to confirm. Attached findings and evidence remain on the engagement — only the checklist is removed.
Playbooks are the KB
Playbooks are stored in the knowledge base as articles with structured metadata. Their content — phases, tasks, tools, references — is fully searchable. You can:
- Open a playbook from the knowledge base to read it without loading it onto an engagement
- Search for a specific task or tool across all playbooks
- Read the methodology behind a playbook without running it
This means the same content serves two purposes: as reference material in the KB, and as a live checklist on an engagement.
Where to go next
- Managing findings — logging what you find
- Using the knowledge base — searching everything
- Your first engagement — the full workflow