mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Branch was auto-updated.
This commit is contained in:
srv-rr-gh-researchbt
@@ -107,7 +107,7 @@
|
||||
"targetPort": "6_in"
|
||||
}
|
||||
],
|
||||
"hash": "da5ffd389f3e278ac939229d65f40ab122d422fe",
|
||||
"hash": "8ad22687b84264bdee2b40d4620b13cb9f7af309",
|
||||
"nodes": {
|
||||
"0": {
|
||||
"data": {
|
||||
@@ -123,7 +123,7 @@
|
||||
"type": "start",
|
||||
"warnings": {},
|
||||
"x": 300,
|
||||
"y": -6.394884621840902e-14
|
||||
"y": -1.2789769243681803e-13
|
||||
},
|
||||
"1": {
|
||||
"data": {
|
||||
@@ -782,7 +782,7 @@
|
||||
"schema": "5.0.9",
|
||||
"version": "6.0.0.114895"
|
||||
},
|
||||
"create_time": "2023-03-02T14:39:31.825576+00:00",
|
||||
"create_time": "2023-04-06T23:23:35.143183+00:00",
|
||||
"draft_mode": false,
|
||||
"labels": [
|
||||
"*"
|
||||
|
Before Width: | Height: | Size: 68 KiB After Width: | Height: | Size: 68 KiB |
@@ -94,11 +94,11 @@ def dispatch_attribute_lookup(action=None, success=None, container=None, results
|
||||
filtered_artifact_0__id = [item[0] for item in filtered_artifact_0_data_new_artifact_filter]
|
||||
|
||||
inputs = {
|
||||
"playbook_tags": ["attributes"],
|
||||
"playbook_repo": [""],
|
||||
"indicator_tags_include": [],
|
||||
"indicator_tags_exclude": [],
|
||||
"playbook_tags": ["attributes"],
|
||||
"artifact_ids_include": filtered_artifact_0__id,
|
||||
"indicator_tags_exclude": [],
|
||||
"indicator_tags_include": [],
|
||||
}
|
||||
|
||||
################################################################################
|
||||
@@ -1,11 +1,11 @@
|
||||
name: Dynamic Attribute Lookup
|
||||
name: Dispatch Attribute Lookup
|
||||
id: fc0edc96-ff2b-68d0-9a4d-63da6783fd64
|
||||
version: 1
|
||||
date: '2023-03-06'
|
||||
author: Lou Stella, Splunk
|
||||
type: Investigation
|
||||
description: "Detects available entities and routes them to attribute lookup playbooks. The output of the playbooks will create new artifacts for any technologies that returned information."
|
||||
playbook: Dynamic_Attribute_Lookup
|
||||
playbook: Dispatch_Attribute_Lookup
|
||||
how_to_implement: This playbook looks for artifacts and then dispatches the community Attribute Lookup playbooks. This playbook takes the output of those playbooks and nicely formats them into new artifacts with their results.
|
||||
references: []
|
||||
app_list: []
|
||||
+4
-4
@@ -142,7 +142,7 @@
|
||||
"type": "start",
|
||||
"warnings": {},
|
||||
"x": 470,
|
||||
"y": 0
|
||||
"y": -6.394884621840902e-14
|
||||
},
|
||||
"1": {
|
||||
"data": {
|
||||
@@ -812,10 +812,10 @@
|
||||
"output_spec": null,
|
||||
"playbook_type": "automation",
|
||||
"python_version": "3",
|
||||
"schema": "5.0.8",
|
||||
"version": "5.5.0.108488"
|
||||
"schema": "5.0.9",
|
||||
"version": "6.0.0.114895"
|
||||
},
|
||||
"create_time": "2023-01-09T22:52:13.357641+00:00",
|
||||
"create_time": "2023-04-06T23:24:14.315536+00:00",
|
||||
"draft_mode": false,
|
||||
"labels": [
|
||||
"*"
|
||||
|
Before Width: | Height: | Size: 157 KiB After Width: | Height: | Size: 157 KiB |
+2
-2
@@ -1,11 +1,11 @@
|
||||
name: Dynamic Identifier Reputation Analysis
|
||||
name: Dispatch Identifier Reputation Analysis
|
||||
id: fc0edc96-ff2b-48b0-9b4d-63da6783fd64
|
||||
version: 1
|
||||
date: '2023-01-11'
|
||||
author: Kelby Shelton, Splunk
|
||||
type: Investigation
|
||||
description: "Detects available indicators and routes them to indicator reputation analysis playbooks. The output of the analysis will update any artifacts, tasks, and indicator tags. https://d3fend.mitre.org/technique/d3f:IdentifierReputationAnalysis/"
|
||||
playbook: Dynamic_Identifier_Reputation_Analysis
|
||||
playbook: Dispatch_Identifier_Reputation_Analysis
|
||||
how_to_implement: This playbook looks for artifacts and then dispatches the community Reputation playbooks. This playbook takes the output of those playbooks and nicely formats them into notes and tags indicators with their results.
|
||||
references:
|
||||
- https://d3fend.mitre.org/technique/d3f:IdentifierReputationAnalysis/
|
||||
+6
-6
@@ -1,10 +1,10 @@
|
||||
{
|
||||
"blockly": false,
|
||||
"blockly_xml": "<xml></xml>",
|
||||
"category": "Dynamic Related Ticket Search",
|
||||
"category": "Related Ticket Search",
|
||||
"coa": {
|
||||
"data": {
|
||||
"description": "Detects available indicators and routes them to dynamic related ticket search playbooks. The output of the analysis will update any artifacts, tasks, and indicator tags.",
|
||||
"description": "Detects available indicators and routes them to dispatch related ticket search playbooks. The output of the analysis will update any artifacts, tasks, and indicator tags.",
|
||||
"edges": [
|
||||
{
|
||||
"conditions": [
|
||||
@@ -107,7 +107,7 @@
|
||||
"targetPort": "10_in"
|
||||
}
|
||||
],
|
||||
"hash": "a6c7d1370562fa8c2c59b56f47c3fd52f27f8b37",
|
||||
"hash": "2cc75fd96e3876d56b54f26dbb247bb868e72852",
|
||||
"nodes": {
|
||||
"0": {
|
||||
"data": {
|
||||
@@ -123,7 +123,7 @@
|
||||
"type": "start",
|
||||
"warnings": {},
|
||||
"x": 300,
|
||||
"y": 0
|
||||
"y": -6.394884621840902e-14
|
||||
},
|
||||
"1": {
|
||||
"data": {
|
||||
@@ -349,7 +349,7 @@
|
||||
"workbook_task_update": {
|
||||
"container": "container:id",
|
||||
"note_content": "merge_reports:formatted_data",
|
||||
"note_title": "Dynamic Related Ticket Search Report",
|
||||
"note_title": "Dispatch Related Ticket Search Report",
|
||||
"owner": null,
|
||||
"status": "complete",
|
||||
"task_name": "playbook"
|
||||
@@ -726,7 +726,7 @@
|
||||
"schema": "5.0.9",
|
||||
"version": "6.0.0.114895"
|
||||
},
|
||||
"create_time": "2023-02-27T20:44:02.427087+00:00",
|
||||
"create_time": "2023-04-06T23:24:47.745007+00:00",
|
||||
"draft_mode": false,
|
||||
"labels": [
|
||||
"*"
|
||||
|
Before Width: | Height: | Size: 72 KiB After Width: | Height: | Size: 72 KiB |
+3
-3
@@ -68,11 +68,11 @@ def dispatch_ticketing_playbooks(action=None, success=None, container=None, resu
|
||||
filtered_artifact_0__id = [item[0] for item in filtered_artifact_0_data_filter_new_artifacts]
|
||||
|
||||
inputs = {
|
||||
"playbook_tags": ["ticket"],
|
||||
"playbook_repo": [],
|
||||
"indicator_tags_include": [],
|
||||
"indicator_tags_exclude": [],
|
||||
"playbook_tags": ["ticket"],
|
||||
"artifact_ids_include": filtered_artifact_0__id,
|
||||
"indicator_tags_exclude": [],
|
||||
"indicator_tags_include": [],
|
||||
}
|
||||
|
||||
################################################################################
|
||||
+3
-3
@@ -1,11 +1,11 @@
|
||||
name: Dynamic Related Tickets Search
|
||||
name: Dispatch Related Tickets Search
|
||||
id: fc0edc96-ab1f-48b9-9b4d-63da61bafe74
|
||||
version: 1
|
||||
date: '2023-02-28'
|
||||
author: Patrick Bareiss, Splunk
|
||||
type: Investigation
|
||||
description: "Detects available indicators and routes them to dynamic related ticket search playbooks. The output of the analysis will update any artifacts, tasks, and indicator tags."
|
||||
playbook: Dynamic_Related_Tickets_Search
|
||||
description: "Detects available indicators and routes them to dispatch related ticket search playbooks. The output of the analysis will update any artifacts, tasks, and indicator tags."
|
||||
playbook: Dispatch_Related_Tickets_Search
|
||||
how_to_implement: This playbook looks for artifacts and then dispatches the community Related Tickets playbooks. This playbook takes the output of those playbooks and nicely formats them into notes and tags indicators with their results.
|
||||
references:
|
||||
- https://d3fend.mitre.org/technique/d3f:IdentifierReputationAnalysis/
|
||||
Reference in New Issue
Block a user