diff --git a/playbooks/log4j_investigate_and_respond.yml b/playbooks/log4j_investigate_and_respond.yml
index 46ce8d2e8f..92109be805 100644
--- a/playbooks/log4j_investigate_and_respond.yml
+++ b/playbooks/log4j_investigate_and_respond.yml
@@ -22,6 +22,18 @@ app_list: []
 tags:
   platform_tags:
   - Response
+  analytic_story:
+  - Log4Shell CVE-2021-44228
+  detections:
+  - Curl Download and Bash Execution
+  - Wget Download and Bash Execution
+  - Linux Java Spawning Shell
+  - Windows Java Spawning Shell
+  - Java Class File download by Java User Agent
+  - Outbound Network Connection from Java Using Default Ports
+  - Log4Shell JNDI Payload Injection Attempt
+  - Log4Shell JNDI Payload Injection with Outbound Connection
+  - Detect Outbound LDAP Traffic
   playbook_fields: []
   product:
   - Splunk SOAR