Branch was auto-updated.

2026-06-08 17:32:49 +00:00 · 2023-09-06 08:54:03 -07:00
parent a676ec8a21 40894a1942
commit 0734bf9890
50 changed files with 162 additions and 81 deletions
@@ -10,7 +10,7 @@ how_to_implement: This input playbook requires the Microsoft AD LDAP connector t
  It is designed to work in conjunction with the Dynamic Attribute Lookup playbook or other playbooks in the same style. 
 references: []
 app_list: 
-  - AD LDAP API
+  - AD LDAP
 tags:
  platform_tags:
    - user
@@ -22,3 +22,7 @@ tags:
  playbook_fields: []
  product:
  - Splunk SOAR
+  use_cases:
+  - Phishing
+  - Endpoint
+  defend_technique_id: D3-AL
@@ -20,4 +20,6 @@ tags:
  vpe_type: Modern
  playbook_fields: []
  product:
-  - Splunk SOAR
+  - Splunk SOAR
+  use_cases:
+  - Enrichment
@@ -10,7 +10,7 @@ how_to_implement: This input playbook requires the AWS IAM connector to be confi
  It is designed to work in conjunction with the Dynamic Attribute Lookup playbook or other playbooks in the same style. 
 references: []
 app_list: 
-  - AWS IAM API
+  - AWS IAM
 tags:
  platform_tags:
    - user
@@ -21,4 +21,8 @@ tags:
  vpe_type: Modern
  playbook_fields: []
  product:
-  - Splunk SOAR
+  - Splunk SOAR
+  use_cases:
+  - Phishing
+  - Endpoint
+  defend_technique_id: D3-AL
@@ -10,9 +10,8 @@ playbook: Active_Directory_Disable_Account_Dispatch
 how_to_implement: This automatic playbook requires "disable_account" tag be present on each input playbook you want to launch.
 references: []
 app_list: 
-  - microsoft_ad_ldap
-  - azure_ad_graph
-  - aws_iam
+  - AD LDAP
+  - Azure AD Graph
 tags:
  platform_tags:
    - user
@@ -22,4 +21,8 @@ tags:
  vpe_type: Modern
  playbook_fields: []
  product:
-  - Splunk SOAR
+  - Splunk SOAR
+  use_cases:
+  - Phishing
+  - Endpoint
+  defend_technique_id: D3-AL
@@ -16,3 +16,5 @@ tags:
  playbook_fields: []
  product:
  - Splunk SOAR
+  use_cases:
+  - Enrichment
@@ -10,7 +10,7 @@ how_to_implement: This input playbook requires the Azure AD Graph connector to b
  It is designed to work in conjunction with the Dynamic Attribute Lookup playbook or other playbooks in the same style. 
 references: []
 app_list: 
-  - Azure AD Graph API
+  - Azure AD Graph
 tags:
  platform_tags:
    - user
@@ -22,3 +22,7 @@ tags:
  playbook_fields: []
  product:
  - Splunk SOAR
+  use_cases:
+  - Phishing
+  - Endpoint
+  defend_technique_id: D3-AL
@@ -20,4 +20,6 @@ tags:
  vpe_type: Modern
  playbook_fields: []
  product:
-  - Splunk SOAR
+  - Splunk SOAR
+  use_cases:
+  - Enrichment
@@ -22,3 +22,7 @@ tags:
  playbook_fields: []
  product:
  - Splunk SOAR
+  use_cases:
+  - Phishing
+  - Endpoint
+  defend_technique_id: D3-DNSDL
@@ -23,3 +23,6 @@ tags:
  playbook_fields: []
  product:
  - Splunk SOAR
+  use_cases:
+  - Enrichment
+  - Endpoint
@@ -23,3 +23,8 @@ tags:
  playbook_fields: []
  product:
  - Splunk SOAR
+  use_cases:
+  - Enrichment
+  - Phishing
+  - Endpoint
+  defend_technique_id: D3-DA
@@ -20,3 +20,7 @@ tags:
  playbook_fields: []
  product:
  - Splunk SOAR
+  use_cases:
+  - Enrichment
+  - Endpoint
+  defend_technique_id: D3-IAA
@@ -17,4 +17,8 @@ tags:
  vpe_type: Modern
  playbook_fields: []
  product:
-  - Splunk SOAR
+  - Splunk SOAR
+  use_cases:
+  - Phishing
+  - Endpoint
+  defend_technique_id: D3-DNSDL
@@ -9,11 +9,7 @@ description: Automatically dispatches input playbooks with the 'sandbox' tag.
 playbook: Dynamic_Analysis_Dispatch
 how_to_implement: This automatic playbook requires "sandbox" tag be present on each input playbook you want to launch.
 references: []
-app_list: 
-  - CrowdStrike OAuth API
-  - urlscan.io
-  - VirusTotal_v3
-  - SAA
+app_list: []
 tags:
  platform_tags:
    - url
@@ -25,4 +21,9 @@ tags:
  vpe_type: Modern
  playbook_fields: []
  product:
-  - Splunk SOAR
+  - Splunk SOAR
+  use_cases:
+  - Enrichment
+  - Phishing
+  - Endpoint
+  defend_technique_id: D3-DA
@@ -20,3 +20,6 @@ tags:
  playbook_fields: []
  product:
  - Splunk SOAR
+  use_cases:
+  - Phishing
+  defend_technique_id: D3-IAA
@@ -15,4 +15,7 @@ tags:
  vpe_type: Modern
  playbook_fields: []
  product:
-  - Splunk SOAR
+  - Splunk SOAR
+  use_cases:
+  - Enrichment
+  defend_technique_id: D3-IAA
@@ -18,3 +18,6 @@ tags:
  playbook_fields: []
  product:
  - Splunk SOAR
+  use_cases:
+  - Enrichment
+  defend_technique_id: D3-IRA
@@ -21,3 +21,7 @@ tags:
  playbook_fields: []
  product:
  - Splunk SOAR
+  use_cases:
+  - Phishing
+  - Endpoint
+  defend_technique_id: D3-OTF
@@ -23,3 +23,7 @@ tags:
  playbook_fields: []
  product:
  - Splunk SOAR
+  use_cases:
+  - Enrichment
+  - Phishing
+  defend_technique_id: D3-IRA
@@ -16,4 +16,6 @@ tags:
  vpe_type: Modern
  playbook_fields: []
  product:
-  - Splunk SOAR
+  - Splunk SOAR
+  use_cases:
+  - Enrichment
@@ -10,7 +10,7 @@ how_to_implement: This input playbook requires the ServiceNow connector to be co
 references:
  - https://d3fend.mitre.org/technique/d3f:IdentifierReputationAnalysis/
 app_list: 
-  - Splunk
+  - ServiceNow
 tags:
  platform_tags:
    - user
@@ -21,4 +21,6 @@ tags:
  vpe_type: Modern
  playbook_fields: []
  product:
-  - Splunk SOAR
+  - Splunk SOAR
+  use_cases:
+  - Enrichment
@@ -9,7 +9,7 @@ playbook: Splunk_Attack_Analyzer_Dynamic_Analysis
 how_to_implement: This input playbook requires the SAA API connector to be configured. It is designed to work in conjunction with the Dynamic Attribute Lookup playbook or other playbooks in the same style. 
 references: []
 app_list: 
-  - Splunk Attack Analyzer API
+  - Splunk Attack Analyzer Connector for Splunk SOAR
 tags:
  platform_tags:
    - url
@@ -21,4 +21,9 @@ tags:
  vpe_type: Modern
  playbook_fields: []
  product:
-  - Splunk SOAR
+  - Splunk SOAR
+  use_cases:
+  - Enrichment
+  - Phishing
+  - Endpoint
+  defend_technique_id: D3-DA
@@ -22,3 +22,6 @@ tags:
  playbook_fields: []
  product:
  - Splunk SOAR
+  use_cases:
+  - Enrichment
+  defend_technique_id: D3-IAA
@@ -21,3 +21,6 @@ tags:
  playbook_fields: []
  product:
  - Splunk SOAR
+  use_cases:
+  - Phishing
+  defend_technique_id: D3-IAA
@@ -21,4 +21,6 @@ tags:
  vpe_type: Modern
  playbook_fields: []
  product:
-  - Splunk SOAR
+  - Splunk SOAR
+  use_cases:
+  - Enrichment
@@ -16,4 +16,8 @@ tags:
  vpe_type: Modern
  playbook_fields: []
  product:
-  - Splunk SOAR
+  - Splunk SOAR
+  use_cases:
+  - Phishing
+  - Endpoint
+  defend_technique_id: D3-OTF
@@ -22,3 +22,8 @@ tags:
  playbook_fields: []
  product:
  - Splunk SOAR
+  use_cases:
+  - Enrichment
+  - Phishing
+  - Endpoint
+  defend_technique_id: D3-DA
@@ -10,7 +10,7 @@ how_to_implement: This input playbook requires the Virustotal V3 API connector t
  It is designed to work in conjunction with the Dynamic Attribute Lookup playbook or other playbooks in the same style. 
 references: []
 app_list: 
-  - virustotal v3
+  - VirusTotal v3
 tags:
  platform_tags:
    - url
@@ -24,3 +24,8 @@ tags:
  playbook_fields: []
  product:
  - Splunk SOAR
+  use_cases:
+  - Enrichment
+  - Phishing
+  - Endpoint
+  defend_technique_id: D3-DA
@@ -28,4 +28,7 @@ tags:
  vpe_type: Modern
  playbook_fields: []
  product:
-  - Splunk SOAR
+  - Splunk SOAR
+  use_cases:
+  - Enrichment
+  defend_technique_id: D3-IRA
@@ -20,3 +20,7 @@ tags:
  playbook_fields: []
  product:
  - Splunk SOAR
+  use_cases:
+  - Enrichment
+  - Endpoint
+  defend_technique_id: D3-IAA
@@ -10,15 +10,19 @@ how_to_implement: This input playbook requires the ZScaler connector to be confi
 references:
  - https://d3fend.mitre.org/technique/d3f:OutboundTrafficFiltering/
 app_list: 
-  - ZScaler
+  - Zscaler
 tags:
  platform_tags:
    - denylist
    - url
    - D3-OTF
-    - ZScaler
+    - Zscaler
  playbook_type: Input
  vpe_type: Modern
  playbook_fields: []
  product:
-  - Splunk SOAR
+  - Splunk SOAR
+  use_cases:
+  - Phishing
+  - Endpoint
+  defend_technique_id: D3-OTF
@@ -9,7 +9,7 @@ playbook: activedirectory_reset_password
 how_to_implement: This playbook works on artifacts with artifact:*.cef.compromisedUserName which can be created as shown in the playbook "recorded_future_handle_leaked_credentials" - The prompt is hard-coded to use "admin" as the user, so change it to the correct user or role
 references: []
 app_list:
- "LDAP"
+- AD LDAP
 tags:
  platform_tags: []
  playbook_type: Automation
@@ -10,7 +10,7 @@ how_to_implement: "This playbook works with the community playbook aws_find_inac
 references: 
 - https://www.splunk.com/en_us/blog/security/splunk-soar-playbooks-finding-and-disabling-inactive-users-on-aws.html
 app_list:
- "AWS IAM"
+- AWS IAM
 tags:
  platform_tags:
  - Cloud
@@ -10,8 +10,8 @@ how_to_implement: "This playbook is meant to run on a Timer, such as once per we
 references: 
 - https://www.splunk.com/en_us/blog/security/splunk-soar-playbooks-finding-and-disabling-inactive-users-on-aws.html
 app_list:
- "AWS IAM"
- "Phantom"
+- AWS IAM
+- Phantom
 tags:
  platform_tags:
  - Cloud
@@ -10,8 +10,8 @@ how_to_implement: "This playbook uses the following custom lists:  ip_address_bl
 references: []
 app_list:
 - "Palo Alto Networks Firewall"
- "CarbonBlack Response"
- "OpenDNS Umbrella"
+- "Carbon Black Response"
+- "Cisco Umbrella"
 tags:
  platform_tags: []
  playbook_type: Automation
@@ -9,7 +9,7 @@ playbook: crowdstrike_malware_triage
 how_to_implement: This playbook uses the Crowdstrike OAuth app. Change the target user of the prompt from admin to the appropriate user or role.
 references: []
 app_list:
- "Crowdstrike OAuth"
+- CrowdStrike OAuth API
 tags:
  platform_tags: []
  playbook_type: Automation
@@ -11,7 +11,7 @@ references: []
 app_list:
 - "VirusTotal"
 - "WildFire"
- "CarbonBlack Response"
+- "Carbon Black Response"
 - "SMTP"
 tags:
  platform_tags: []
@@ -11,7 +11,7 @@ references: []
 app_list:
 - "Splunk"
 - "Reversing Labs"
- "CarbonBlack Response"
+- "Carbon Black Response"
 - "Threat Grid"
 - "Falcon Host API"
 tags:
@@ -11,7 +11,7 @@ references: []
 app_list:
 - "LDAP"
 - "ServiceNow"
- "CarbonBlack Response"
+- "Carbon Black Response"
 - "VirusTotal"
 tags:
  platform_tags: []
@@ -6,12 +6,11 @@ author: Kelby Shelton, Splunk
 type: Response
 description: This playbook handles locating indicators marked for blocking and determining if any blocking playbooks exist. If there is a match to the appropriate tags in the playbook, a filter block routes the name of the playbook to launch to a code block.
 playbook: risk_notable_block_indicators
-how_to_implement: tbd
+how_to_implement: For detailed implementation see https://docs.splunk.com/Documentation/ESSOC/latest/user/Useplaybookpack
 references:
 - https://docs.splunk.com/Documentation/ESSOC/latest/user/Useplaybookpack#Call_child_playbooks_with_the_dynamic_playbook_system
 - https://docs.splunk.com/Documentation/ESSOC/latest/user/Useplaybookpack#Indicator_tagging_system
-app_list: 
-  - "None"
+app_list: []
 tags:
  labels:
  - risk_notable
@@ -6,11 +6,10 @@ author: Kelby Shelton, Splunk
 type: Investigation
 description: This playbook collects the available Indicator data types within the event as well as available investigative playbooks. It will launch any playbooks that meet the filtered criteria.
 playbook: risk_notable_enrich
-how_to_implement: tbd
+how_to_implement: For detailed implementation see https://docs.splunk.com/Documentation/ESSOC/latest/user/Useplaybookpack
 references:
 - https://docs.splunk.com/Documentation/ESSOC/latest/user/Useplaybookpack#Call_child_playbooks_with_the_dynamic_playbook_system
-app_list: 
-  - "None"
+app_list: []
 tags:
  labels:
  - risk_notable
@@ -6,21 +6,7 @@ author: Kelby Shelton, Splunk
 type: Investigation
 description: This playbook gathers all of the events associated with the risk notable and imports them as artifacts. It also generates a custom markdown formatted note.
 playbook: risk_notable_import_data
-how_to_implement: >
-  The Splunk search used to locate contributing events requires three fields in the notable artifact\: risk_object, info_min_time, and info_max_time. The query also performs some deduplication on contributing events and may need to be adjusted based on individual Enterprise Security environments. Mitre Tactics and Techniques appear if using the annotation framework in Splunk ES."
-
-  ```index=risk risk_object=\"{0}\" earliest=\"{1}\" latest="{2}\"
-  | rex field=source \".*-\s(?<source>.*)\s+-\s+\w+\s+-\s+Rule\"
-  | fillnull value=\"unknown\" threat_object
-  | eval risk_message=coalesce(risk_message,source)
-  | stats values(*) as * by _time source threat_object risk_message
-  | rename annotations.mitre_attack.mitre_technique_id as mitre_technique_id annotations.mitre_attack.mitre_tactic as mitre_tactic annotations.mitre_attack.mitre_technique as mitre_technique
-  | fields - annotations* risk_object_* date_* orig_* user_* src_user_* src_* dest_* dest_user_* info_* search_* splunk_* tag* risk_modifier* risk_rule* sourcetype timestamp index next_cron_time timeendpos timestartpos testmode linecount
-  | sort + _time
-  | `uitime(_time)`
-  | dedup source threat_object```
-
-  A custom code block sorts the returned event data and produces a markdown formatted note into the note_content output field. This field is then available for use in downstream playbooks."
+how_to_implement: For detailed implementation see https://docs.splunk.com/Documentation/ESSOC/latest/user/Useplaybookpack
 references:
 - https://docs.splunk.com/Documentation/ESSOC/latest/user/Useplaybookpack
 - http://docs.splunk.com/Documentation/ES/6.6.2/Admin/Configurecorrelationsearches#Use_security_framework_annotations_in_correlation_searches
@@ -6,11 +6,10 @@ author: Kelby Shelton, Splunk
 type: Investigation
 description: This playbook checks for the presence of the Risk Investigation workbook and updates tasks or leaves generic notes.
 playbook: risk_notable_investigate
-how_to_implement: Set this playbook to run in Active mode on the Risk Notable label in Splunk SOAR.
+how_to_implement: For detailed implementation see https://docs.splunk.com/Documentation/ESSOC/latest/user/Useplaybookpack
 references:
 - https://docs.splunk.com/Documentation/ESSOC/latest/user/Useplaybookpack
-app_list:
-  - "None"
+app_list: []
 tags:
  labels:
  - risk_notable
@@ -6,11 +6,10 @@ author: Kelby Shelton, Splunk
 type: Investigation
 description: This playbook finds related events based on key fields in a risk notable and allows the user to process the results and decide which events to merge into the current investigation.
 playbook: risk_notable_merge_events
-how_to_implement: Combining the list_merge utility within the playbook with the find_related_containers utility allows for fine-tuning of related event criteria. For example, the default filtering criteria uses description, risk_object, and threat_object as the important fields and requires at least three matches before an event is considered related. There are several options to customize the associated criteria, including adding more fields in list_merge, reducing or increasing the minimum match count, or utilizing the wildcard feature of find_related_containers.
+how_to_implement: For detailed implementation see https://docs.splunk.com/Documentation/ESSOC/latest/user/Useplaybookpack
 references:
 - https://docs.splunk.com/Documentation/ESSOC/latest/user/Useplaybookpack
-app_list:
-  - "None"
+app_list: []
 tags:
  labels:
  - risk_notable
@@ -6,7 +6,7 @@ author: Kelby Shelton, Splunk
 type: Response
 description: This playbook checks for the presence of the Risk Response workbook and updates tasks or leaves generic notes. The risk_notable_verdict playbooks recommends this playbook as a second phase of the investigation. Additionally, this playbook can be used in ad-hoc investigations or incorporated into custom workbooks.
 playbook: risk_notable_mitigate
-how_to_implement: tbd
+how_to_implement: For detailed implementation see https://docs.splunk.com/Documentation/ESSOC/latest/user/Useplaybookpack
 references:
 - https://docs.splunk.com/Documentation/ESSOC/latest/user/Useplaybookpack
 app_list: []
@@ -10,7 +10,7 @@ description: >
  2. Posts a link to this container in the comment field of Splunk ES.
  3. Updates the container name, description, and severity to reflect the data in the notable artifact."
 playbook: risk_notable_preprocess
-how_to_implement: tbd
+how_to_implement: For detailed implementation see https://docs.splunk.com/Documentation/ESSOC/latest/user/Useplaybookpack
 references:
 - https://docs.splunk.com/Documentation/ESSOC/latest/user/Useplaybookpack
 app_list:
@@ -6,11 +6,10 @@ author: Kelby Shelton, Splunk
 type: Response
 description: This playbook attempts to find assets and users from the notable event and match those with assets and identities from Splunk ES. If a match was found and the user has playbooks available to contain entities, the analyst decides which entities to disable or quarantine.
 playbook: risk_notable_protect_assets_and_users
-how_to_implement: tbd
+how_to_implement: For detailed implementation see https://docs.splunk.com/Documentation/ESSOC/latest/user/Useplaybookpack
 references:
 - https://docs.splunk.com/Documentation/ESSOC/latest/user/Useplaybookpack#Call_child_playbooks_with_the_dynamic_playbook_system
-app_list:
-  - "None"
+app_list: []
 tags:
  labels:
  - risk_notable
@@ -6,11 +6,10 @@ author: Kelby Shelton, Splunk
 type: Response
 description: This playbook was designed to be called by a user to process indicators that are marked as suspicious within the SOAR platform. Analysts will review indicators in a prompt and mark them as blocked or safe.
 playbook: risk_notable_review_indicators
-how_to_implement: tbd
+how_to_implement: For detailed implementation see https://docs.splunk.com/Documentation/ESSOC/latest/user/Useplaybookpack
 references:
 - https://docs.splunk.com/Documentation/ESSOC/latest/user/Useplaybookpack#Indicator_tagging_system
-app_list:
-  - "None"
+app_list: []
 tags:
  labels:
  - risk_notable
@@ -6,11 +6,10 @@ author: Kelby Shelton, Splunk
 type: Response
 description: This playbook locates available playbooks with the response tag and presents them to the analyst. Based on the analyst selection, it will launch its chosen playbook.
 playbook: risk_notable_verdict
-how_to_implement: tbd
+how_to_implement: For detailed implementation see https://docs.splunk.com/Documentation/ESSOC/latest/user/Useplaybookpack
 references:
 - https://docs.splunk.com/Documentation/ESSOC/latest/user/Useplaybookpack#Call_child_playbooks_with_the_dynamic_playbook_system
-app_list:
-  - "None"
+app_list: []
 tags:
  labels:
  - risk_notable
@@ -1,8 +1,8 @@
 attackcti==0.3.9
 docker==6.1.3
-GitPython==3.1.32
+GitPython==3.1.33
 Jinja2==3.1.2
-jsonschema==4.17.3
+jsonschema==4.19.0
 mock==4.0.3
 psutil==5.9.5
 pycvesearch==1.2
@@ -108,7 +108,8 @@
                    "detections": "Conti Common Exec parameter",
                    "platform_tags": "Investigate",
                    "playbook_fields": "Username",
-                    "product": "Splunk SOAR"
+                    "product": "Splunk SOAR",
+                    "defend_technique_id": "D3-DA"
                }
            ],
            "minItems": 1,