Arcana: A Unified Framework for Incident Response Documentation and Knowledge Management
summary
A practical IR documentation framework released publicly on Atlassian’s GitHub at FIRSTCON26, Arcana provides 19 playbooks, ~90 runbooks and SOP templates, enforces markdown + git workflows for versioning, ownership, PR reviews and CI/CD publishing to Confluence, and tests internally at Atlian. Runbooks stay short (runbooks limited to 10 steps) and link to SOPs and KB deep dives; SOPs require pre-approval. The repo aims to cut documentation sprawl, make docs audit-ready and reduce mean time to respond by making playbooks executable or agent‑interpretable.
AI-written summary · about
chapters (15)
- 0:00Introduction
- 1:04IR documentation problems
- 9:07Introducing Arcana framework
- 14:25Arcana documentation principles
- 17:12Incident Response Plan structure
- 18:35Playbooks in incident response
- 21:45Runbooks as guides
- 23:07Standard Operating Procedures and their importance
- 24:49Knowledge base deep dive
- 26:58Post-incident reviews
- 28:44Arcana workflow
- 30:10Open sourcing Arcana
- 31:55Contributing to Arcana
- 32:38Future roadmap
- 34:02Q&A
related talks
28mBeyond Incident Reporting - An Analysis of Structured Representations for Incident Response
30mThe Blue Side of Documentation
18mTechnical Documentation - How Can I Write Them Better and Why Should I Care?
48mDown the Ivory Tower towards Agile Architecture
47mDocumentation Is Fine, Don't Worry
23mEnforcing Your Code of Conduct: Effective Incident Response
36mModernizing Incident Response with LLMs, RAG, and the MCP
16mStreamlining security auditing with generative AI