Category playbook driven incident response