Runbooks can automate and carry out the early-stage processes of evaluating and examining security incidents until a human analyst is needed to intervene. They can automate the threat management operations from detection and triage to investigation and containment. For example, in a spearphishing runbook, indicators are extracted from the phishing email, checked through different threat services, and subsequently, blocked if they are found malicious.