From b7296e551ad20847f6157205a010e8314948c662 Mon Sep 17 00:00:00 2001 From: Lou Stella Date: Fri, 25 Feb 2022 14:44:58 -0600 Subject: [PATCH] Added playbook_type field --- playbooks/activedirectory_reset_password.yml | 1 + playbooks/aws_disable_user_accounts.yml | 1 + playbooks/aws_find_inactive_users.yml | 1 + playbooks/block_indicators.yml | 1 + playbooks/crowdstrike_malware_triage.yml | 1 + playbooks/delete_detected_files.yml | 1 + playbooks/email_notification_for_malware.yml | 1 + playbooks/internal_host_splunk_investigate_log4j.yml | 1 + playbooks/internal_host_ssh_investigate.yml | 1 + playbooks/internal_host_ssh_log4j_investigate.yml | 1 + playbooks/internal_host_ssh_log4j_respond.yml | 1 + playbooks/internal_host_winrm_investigate.yml | 1 + playbooks/internal_host_winrm_log4j_investigate.yml | 1 + playbooks/internal_host_winrm_log4j_respond.yml | 1 + playbooks/log4j_investigate.yml | 1 + playbooks/log4j_respond.yml | 1 + playbooks/malware_hunt_and_contain.yml | 1 + playbooks/ransomware_investigate_and_contain.yml | 1 + playbooks/risk_notable_block_indicators.yml | 1 + playbooks/risk_notable_enrich.yml | 1 + playbooks/risk_notable_import_data.yml | 1 + playbooks/risk_notable_investigate.yml | 1 + playbooks/risk_notable_merge_events.yml | 1 + playbooks/risk_notable_mitigate.yml | 1 + playbooks/risk_notable_preprocess.yml | 1 + playbooks/risk_notable_protect_assets_and_users.yml | 1 + playbooks/risk_notable_review_indicators.yml | 1 + playbooks/risk_notable_verdict.yml | 1 + playbooks/start_investigation.yml | 1 + playbooks/threat_intel_investigate.yml | 1 + playbooks/trustar_enrich_indicators.yml | 1 + 31 files changed, 31 insertions(+) diff --git a/playbooks/activedirectory_reset_password.yml b/playbooks/activedirectory_reset_password.yml index 93bf24ddb3..0586ae5076 100644 --- a/playbooks/activedirectory_reset_password.yml +++ b/playbooks/activedirectory_reset_password.yml @@ -12,6 +12,7 @@ app_list: - "LDAP" tags: platform_tags: [] + playbook_type: Automation playbook_fields: - compromisedUserName product: diff --git a/playbooks/aws_disable_user_accounts.yml b/playbooks/aws_disable_user_accounts.yml index c09f103fed..de055065f7 100644 --- a/playbooks/aws_disable_user_accounts.yml +++ b/playbooks/aws_disable_user_accounts.yml @@ -14,6 +14,7 @@ app_list: tags: platform_tags: - Cloud + playbook_type: Input playbook_fields: - aws_username product: diff --git a/playbooks/aws_find_inactive_users.yml b/playbooks/aws_find_inactive_users.yml index 7e0fabfdc3..37580b6093 100644 --- a/playbooks/aws_find_inactive_users.yml +++ b/playbooks/aws_find_inactive_users.yml @@ -15,6 +15,7 @@ app_list: tags: platform_tags: - Cloud + playbook_type: Automation playbook_fields: [] product: - Splunk SOAR \ No newline at end of file diff --git a/playbooks/block_indicators.yml b/playbooks/block_indicators.yml index b1686ff23d..bd50121ece 100644 --- a/playbooks/block_indicators.yml +++ b/playbooks/block_indicators.yml @@ -14,6 +14,7 @@ app_list: - "OpenDNS Umbrella" tags: platform_tags: [] + playbook_type: Automation playbook_fields: - destinationDnsDomain - destinationAddress diff --git a/playbooks/crowdstrike_malware_triage.yml b/playbooks/crowdstrike_malware_triage.yml index 292b830119..eef531f13f 100644 --- a/playbooks/crowdstrike_malware_triage.yml +++ b/playbooks/crowdstrike_malware_triage.yml @@ -12,6 +12,7 @@ app_list: - "Crowdstrike OAuth" tags: platform_tags: [] + playbook_type: Automation playbook_fields: - filePath - destinationAddress diff --git a/playbooks/delete_detected_files.yml b/playbooks/delete_detected_files.yml index 3e41aae6f5..f97a071ab6 100644 --- a/playbooks/delete_detected_files.yml +++ b/playbooks/delete_detected_files.yml @@ -16,6 +16,7 @@ tags: detections: - Executable File Written in Administrative SMB Share platform_tags: [] + playbook_type: Automation playbook_fields: - filePath - destinationAddress diff --git a/playbooks/email_notification_for_malware.yml b/playbooks/email_notification_for_malware.yml index 6afbc2d9f8..5327b71a32 100644 --- a/playbooks/email_notification_for_malware.yml +++ b/playbooks/email_notification_for_malware.yml @@ -15,6 +15,7 @@ app_list: - "SMTP" tags: platform_tags: [] + playbook_type: Automation playbook_fields: - fileHash - vaultId diff --git a/playbooks/internal_host_splunk_investigate_log4j.yml b/playbooks/internal_host_splunk_investigate_log4j.yml index 59c4fec939..17074df9e5 100644 --- a/playbooks/internal_host_splunk_investigate_log4j.yml +++ b/playbooks/internal_host_splunk_investigate_log4j.yml @@ -15,6 +15,7 @@ tags: analytic_story: - Log4Shell CVE-2021-44228 platform_tags: [] + playbook_type: Input playbook_fields: - hostName - destinationAddress diff --git a/playbooks/internal_host_ssh_investigate.yml b/playbooks/internal_host_ssh_investigate.yml index 0604c74c52..a76aaa0521 100644 --- a/playbooks/internal_host_ssh_investigate.yml +++ b/playbooks/internal_host_ssh_investigate.yml @@ -12,6 +12,7 @@ app_list: - "SSH" tags: platform_tags: [] + playbook_type: Input playbook_fields: [] product: - Splunk SOAR diff --git a/playbooks/internal_host_ssh_log4j_investigate.yml b/playbooks/internal_host_ssh_log4j_investigate.yml index 8d63eb9780..ab59dfeb03 100644 --- a/playbooks/internal_host_ssh_log4j_investigate.yml +++ b/playbooks/internal_host_ssh_log4j_investigate.yml @@ -12,6 +12,7 @@ app_list: - "SSH" tags: platform_tags: [] + playbook_type: Input playbook_fields: [] product: - Splunk SOAR diff --git a/playbooks/internal_host_ssh_log4j_respond.yml b/playbooks/internal_host_ssh_log4j_respond.yml index e42634649b..8a529055fc 100644 --- a/playbooks/internal_host_ssh_log4j_respond.yml +++ b/playbooks/internal_host_ssh_log4j_respond.yml @@ -12,6 +12,7 @@ app_list: - "SSH" tags: platform_tags: [] + playbook_type: Input playbook_fields: [] product: - Splunk SOAR diff --git a/playbooks/internal_host_winrm_investigate.yml b/playbooks/internal_host_winrm_investigate.yml index 8db5966975..7fdc684799 100644 --- a/playbooks/internal_host_winrm_investigate.yml +++ b/playbooks/internal_host_winrm_investigate.yml @@ -12,6 +12,7 @@ app_list: - "Windows Remote Management" tags: platform_tags: [] + playbook_type: Input playbook_fields: [] product: - Splunk SOAR diff --git a/playbooks/internal_host_winrm_log4j_investigate.yml b/playbooks/internal_host_winrm_log4j_investigate.yml index d90fc2c6f8..6252cd96ae 100644 --- a/playbooks/internal_host_winrm_log4j_investigate.yml +++ b/playbooks/internal_host_winrm_log4j_investigate.yml @@ -12,6 +12,7 @@ app_list: - "Windows Remote Management" tags: platform_tags: [] + playbook_type: Input playbook_fields: [] product: - Splunk SOAR diff --git a/playbooks/internal_host_winrm_log4j_respond.yml b/playbooks/internal_host_winrm_log4j_respond.yml index 1987ff3685..8341080187 100644 --- a/playbooks/internal_host_winrm_log4j_respond.yml +++ b/playbooks/internal_host_winrm_log4j_respond.yml @@ -12,6 +12,7 @@ app_list: - "Windows Remote Management" tags: platform_tags: [] + playbook_type: Input playbook_fields: [] product: - Splunk SOAR diff --git a/playbooks/log4j_investigate.yml b/playbooks/log4j_investigate.yml index 01d648e0a4..25e7e6c816 100644 --- a/playbooks/log4j_investigate.yml +++ b/playbooks/log4j_investigate.yml @@ -30,5 +30,6 @@ tags: - Log4Shell JNDI Payload Injection with Outbound Connection - Detect Outbound LDAP Traffic playbook_fields: [] + playbook_type: Automation product: - Splunk SOAR diff --git a/playbooks/log4j_respond.yml b/playbooks/log4j_respond.yml index ddbb3e6c45..15bd0a34d2 100644 --- a/playbooks/log4j_respond.yml +++ b/playbooks/log4j_respond.yml @@ -30,5 +30,6 @@ tags: - Log4Shell JNDI Payload Injection with Outbound Connection - Detect Outbound LDAP Traffic playbook_fields: [] + playbook_type: Automation product: - Splunk SOAR diff --git a/playbooks/malware_hunt_and_contain.yml b/playbooks/malware_hunt_and_contain.yml index 9d60cffa84..8b0e78dfe3 100644 --- a/playbooks/malware_hunt_and_contain.yml +++ b/playbooks/malware_hunt_and_contain.yml @@ -15,6 +15,7 @@ app_list: - "VirusTotal" tags: platform_tags: [] + playbook_type: Automation playbook_fields: - fileHash product: diff --git a/playbooks/ransomware_investigate_and_contain.yml b/playbooks/ransomware_investigate_and_contain.yml index 49aaebbb68..13e3766a3a 100644 --- a/playbooks/ransomware_investigate_and_contain.yml +++ b/playbooks/ransomware_investigate_and_contain.yml @@ -22,6 +22,7 @@ tags: - Conti Common Exec parameter platform_tags: - Ransomware + playbook_type: Automation playbook_fields: - ComputerName - Username diff --git a/playbooks/risk_notable_block_indicators.yml b/playbooks/risk_notable_block_indicators.yml index 6edafdbfac..836ae15d21 100644 --- a/playbooks/risk_notable_block_indicators.yml +++ b/playbooks/risk_notable_block_indicators.yml @@ -18,6 +18,7 @@ tags: playbook_outputs: - note_title - note_content + playbook_type: Automation platform_tags: - Risk Notable product: diff --git a/playbooks/risk_notable_enrich.yml b/playbooks/risk_notable_enrich.yml index 0b1b6a260e..cc9e59cf7b 100644 --- a/playbooks/risk_notable_enrich.yml +++ b/playbooks/risk_notable_enrich.yml @@ -17,6 +17,7 @@ tags: playbook_outputs: - note_title - note_content + playbook_type: Automation platform_tags: - Risk Notable product: diff --git a/playbooks/risk_notable_import_data.yml b/playbooks/risk_notable_import_data.yml index 6fd5db62bf..352f9ed240 100644 --- a/playbooks/risk_notable_import_data.yml +++ b/playbooks/risk_notable_import_data.yml @@ -34,6 +34,7 @@ tags: - note_content platform_tags: - Risk Notable + playbook_type: Automation playbook_fields: - event_id - info_min_time diff --git a/playbooks/risk_notable_investigate.yml b/playbooks/risk_notable_investigate.yml index fcdd1261da..cc65a769a2 100644 --- a/playbooks/risk_notable_investigate.yml +++ b/playbooks/risk_notable_investigate.yml @@ -14,6 +14,7 @@ app_list: tags: labels: - risk_notable + playbook_type: Automation platform_tags: - Risk Notable product: diff --git a/playbooks/risk_notable_merge_events.yml b/playbooks/risk_notable_merge_events.yml index bc01af1ae6..1122af6afb 100644 --- a/playbooks/risk_notable_merge_events.yml +++ b/playbooks/risk_notable_merge_events.yml @@ -17,6 +17,7 @@ tags: playbook_outputs: - note_title - note_content + playbook_type: Automation platform_tags: - Risk Notable product: diff --git a/playbooks/risk_notable_mitigate.yml b/playbooks/risk_notable_mitigate.yml index 8da0b25461..fd40aaa74f 100644 --- a/playbooks/risk_notable_mitigate.yml +++ b/playbooks/risk_notable_mitigate.yml @@ -13,6 +13,7 @@ app_list: tags: labels: - risk_notable + playbook_type: Automation platform_tags: - Risk Notable product: diff --git a/playbooks/risk_notable_preprocess.yml b/playbooks/risk_notable_preprocess.yml index c90c69d268..f202663f30 100644 --- a/playbooks/risk_notable_preprocess.yml +++ b/playbooks/risk_notable_preprocess.yml @@ -20,6 +20,7 @@ tags: - risk_notable platform_tags: - Risk Notable + playbook_type: Automation playbook_fields: - event_id - info_min_time diff --git a/playbooks/risk_notable_protect_assets_and_users.yml b/playbooks/risk_notable_protect_assets_and_users.yml index 5e0814f400..3bd2ecdb38 100644 --- a/playbooks/risk_notable_protect_assets_and_users.yml +++ b/playbooks/risk_notable_protect_assets_and_users.yml @@ -16,6 +16,7 @@ tags: playbook_outputs: - note_title - note_content + playbook_type: Automation platform_tags: - Risk Notable product: diff --git a/playbooks/risk_notable_review_indicators.yml b/playbooks/risk_notable_review_indicators.yml index ed24f18b4b..129d8413d7 100644 --- a/playbooks/risk_notable_review_indicators.yml +++ b/playbooks/risk_notable_review_indicators.yml @@ -15,5 +15,6 @@ tags: - risk_notable platform_tags: - Risk Notable + playbook_type: Automation product: - Splunk SOAR diff --git a/playbooks/risk_notable_verdict.yml b/playbooks/risk_notable_verdict.yml index 6470de0a70..2d90aa3a8d 100644 --- a/playbooks/risk_notable_verdict.yml +++ b/playbooks/risk_notable_verdict.yml @@ -15,5 +15,6 @@ tags: - risk_notable platform_tags: - Risk Notable + playbook_type: Automation product: - Splunk SOAR diff --git a/playbooks/start_investigation.yml b/playbooks/start_investigation.yml index d6f4890ba2..6d497d8625 100644 --- a/playbooks/start_investigation.yml +++ b/playbooks/start_investigation.yml @@ -12,5 +12,6 @@ app_list: [] tags: platform_tags: [] playbook_fields: [] + playbook_type: Automation product: - Splunk SOAR \ No newline at end of file diff --git a/playbooks/threat_intel_investigate.yml b/playbooks/threat_intel_investigate.yml index 65a3095b34..918f813e98 100644 --- a/playbooks/threat_intel_investigate.yml +++ b/playbooks/threat_intel_investigate.yml @@ -13,6 +13,7 @@ app_list: [] tags: platform_tags: - threat_intel + playbook_type: Automation playbook_fields: [] product: - Splunk SOAR \ No newline at end of file diff --git a/playbooks/trustar_enrich_indicators.yml b/playbooks/trustar_enrich_indicators.yml index 62e2d30c7e..5cd35f9aa0 100644 --- a/playbooks/trustar_enrich_indicators.yml +++ b/playbooks/trustar_enrich_indicators.yml @@ -15,6 +15,7 @@ tags: platform_tags: - threat_intel - risk_notable + playbook_type: Input playbook_fields: - indicators product: