SOP-17: Zero-Day Exploitation Response

Analyst playbook for zero-day vulnerabilities — scoping via CMDB, 60-day IOC hunt, virtual patching via WAF/NSG/feature-disable, emergency patching, post-patch validation, vendor advisory triage.