\cleardoublepage \part{Appendices and Reference} \setbookpart{Appendices and Reference}
Appendices and Reference
The appendices provide the reference material and reusable artefacts that support the main narrative. They are designed to be used directly: copied into repositories, adapted to the organisation's contracts, works agreements and national law, and kept under version control alongside the decisions they support.
The Glossary defines the vocabulary of the book: the five blue team functions, the degrees of delegation and usage modes, the book's artefacts and the European regulatory terms.
Appendix A: Code Examples contains fuller versions of the artefacts introduced in the chapters: team function map and charter, delegation profile and register, detection record, closure policy, case record, playbook manifest, hunt record, post-incident review, mandate manifest for a SOC agent, review protocol, role charter, reporting-clock configuration and the board page. In keeping with the book's rules it contains no attack tooling.
Appendix B: Templates and Tools is a directory of the templates and tools the chapters provide, each with its purpose, when to use it and the chapter that introduces it.
References and Sources collects every numbered source cited in the chapters.
About the Author provides context for the perspective behind this book and the other volumes of The Architecture as Code Series.
What you will find in this section:
- A glossary of blue team, security and European regulatory terms
- Adaptable detection, case, playbook, mandate and review artefacts
- A directory of templates and tools with the chapter that introduces each
- The consolidated bibliography behind every inline citation