From 7c6b3e35151ae64f7cc314ca6b62da45418f7ed5 Mon Sep 17 00:00:00 2001 From: Lou Stella Date: Wed, 26 Oct 2022 15:43:37 -0500 Subject: [PATCH] Added vpe_type tag to playbook yamls --- playbooks/activedirectory_reset_password.yml | 1 + playbooks/aws_disable_user_accounts.yml | 1 + playbooks/aws_find_inactive_users.yml | 1 + playbooks/block_indicators.yml | 1 + playbooks/crowdstrike_malware_triage.yml | 1 + playbooks/delete_detected_files.yml | 1 + playbooks/email_notification_for_malware.yml | 1 + playbooks/hunting.yml | 1 + playbooks/internal_host_splunk_investigate_log4j.yml | 1 + playbooks/internal_host_ssh_investigate.yml | 1 + playbooks/internal_host_ssh_log4j_investigate.yml | 1 + playbooks/internal_host_ssh_log4j_respond.yml | 1 + playbooks/internal_host_winrm_investigate.yml | 1 + playbooks/internal_host_winrm_log4j_investigate.yml | 1 + playbooks/internal_host_winrm_log4j_respond.yml | 1 + playbooks/log4j_investigate.yml | 1 + playbooks/log4j_respond.yml | 1 + playbooks/malware_hunt_and_contain.yml | 1 + playbooks/ransomware_investigate_and_contain.yml | 1 + playbooks/risk_notable_block_indicators.yml | 1 + playbooks/risk_notable_enrich.yml | 1 + playbooks/risk_notable_import_data.yml | 1 + playbooks/risk_notable_investigate.yml | 1 + playbooks/risk_notable_merge_events.yml | 1 + playbooks/risk_notable_mitigate.yml | 1 + playbooks/risk_notable_preprocess.yml | 1 + playbooks/risk_notable_protect_assets_and_users.yml | 1 + playbooks/risk_notable_review_indicators.yml | 1 + playbooks/risk_notable_verdict.yml | 1 + playbooks/start_investigation.yml | 1 + playbooks/threat_intel_investigate.yml | 1 + playbooks/trustar_enrich_indicators.yml | 1 + 32 files changed, 32 insertions(+) diff --git a/playbooks/activedirectory_reset_password.yml b/playbooks/activedirectory_reset_password.yml index 0586ae5076..a8b2c9bed9 100644 --- a/playbooks/activedirectory_reset_password.yml +++ b/playbooks/activedirectory_reset_password.yml @@ -13,6 +13,7 @@ app_list: tags: platform_tags: [] playbook_type: Automation + vpe_type: Classic playbook_fields: - compromisedUserName product: diff --git a/playbooks/aws_disable_user_accounts.yml b/playbooks/aws_disable_user_accounts.yml index de055065f7..ccb513fda0 100644 --- a/playbooks/aws_disable_user_accounts.yml +++ b/playbooks/aws_disable_user_accounts.yml @@ -15,6 +15,7 @@ tags: platform_tags: - Cloud playbook_type: Input + vpe_type: Modern playbook_fields: - aws_username product: diff --git a/playbooks/aws_find_inactive_users.yml b/playbooks/aws_find_inactive_users.yml index 37580b6093..c95fd59e44 100644 --- a/playbooks/aws_find_inactive_users.yml +++ b/playbooks/aws_find_inactive_users.yml @@ -16,6 +16,7 @@ tags: platform_tags: - Cloud playbook_type: Automation + vpe_type: Modern playbook_fields: [] product: - Splunk SOAR \ No newline at end of file diff --git a/playbooks/block_indicators.yml b/playbooks/block_indicators.yml index bd50121ece..05fbca3fae 100644 --- a/playbooks/block_indicators.yml +++ b/playbooks/block_indicators.yml @@ -15,6 +15,7 @@ app_list: tags: platform_tags: [] playbook_type: Automation + vpe_type: Classic playbook_fields: - destinationDnsDomain - destinationAddress diff --git a/playbooks/crowdstrike_malware_triage.yml b/playbooks/crowdstrike_malware_triage.yml index eef531f13f..585229fd2e 100644 --- a/playbooks/crowdstrike_malware_triage.yml +++ b/playbooks/crowdstrike_malware_triage.yml @@ -13,6 +13,7 @@ app_list: tags: platform_tags: [] playbook_type: Automation + vpe_type: Classic playbook_fields: - filePath - destinationAddress diff --git a/playbooks/delete_detected_files.yml b/playbooks/delete_detected_files.yml index f97a071ab6..2b3a782086 100644 --- a/playbooks/delete_detected_files.yml +++ b/playbooks/delete_detected_files.yml @@ -17,6 +17,7 @@ tags: - Executable File Written in Administrative SMB Share platform_tags: [] playbook_type: Automation + vpe_type: Classic playbook_fields: - filePath - destinationAddress diff --git a/playbooks/email_notification_for_malware.yml b/playbooks/email_notification_for_malware.yml index 5327b71a32..d3fe969c17 100644 --- a/playbooks/email_notification_for_malware.yml +++ b/playbooks/email_notification_for_malware.yml @@ -16,6 +16,7 @@ app_list: tags: platform_tags: [] playbook_type: Automation + vpe_type: Classic playbook_fields: - fileHash - vaultId diff --git a/playbooks/hunting.yml b/playbooks/hunting.yml index 4dc40bc20b..f4b8d8befa 100644 --- a/playbooks/hunting.yml +++ b/playbooks/hunting.yml @@ -17,6 +17,7 @@ app_list: tags: platform_tags: [] playbook_type: Automation + vpe_type: Classic playbook_fields: - fileHash - vault_id diff --git a/playbooks/internal_host_splunk_investigate_log4j.yml b/playbooks/internal_host_splunk_investigate_log4j.yml index 17074df9e5..04207c9873 100644 --- a/playbooks/internal_host_splunk_investigate_log4j.yml +++ b/playbooks/internal_host_splunk_investigate_log4j.yml @@ -16,6 +16,7 @@ tags: - Log4Shell CVE-2021-44228 platform_tags: [] playbook_type: Input + vpe_type: Modern playbook_fields: - hostName - destinationAddress diff --git a/playbooks/internal_host_ssh_investigate.yml b/playbooks/internal_host_ssh_investigate.yml index a76aaa0521..97f8129549 100644 --- a/playbooks/internal_host_ssh_investigate.yml +++ b/playbooks/internal_host_ssh_investigate.yml @@ -13,6 +13,7 @@ app_list: tags: platform_tags: [] playbook_type: Input + vpe_type: Modern playbook_fields: [] product: - Splunk SOAR diff --git a/playbooks/internal_host_ssh_log4j_investigate.yml b/playbooks/internal_host_ssh_log4j_investigate.yml index ab59dfeb03..b8f18b921f 100644 --- a/playbooks/internal_host_ssh_log4j_investigate.yml +++ b/playbooks/internal_host_ssh_log4j_investigate.yml @@ -13,6 +13,7 @@ app_list: tags: platform_tags: [] playbook_type: Input + vpe_type: Modern playbook_fields: [] product: - Splunk SOAR diff --git a/playbooks/internal_host_ssh_log4j_respond.yml b/playbooks/internal_host_ssh_log4j_respond.yml index 8a529055fc..78ab27d8b7 100644 --- a/playbooks/internal_host_ssh_log4j_respond.yml +++ b/playbooks/internal_host_ssh_log4j_respond.yml @@ -13,6 +13,7 @@ app_list: tags: platform_tags: [] playbook_type: Input + vpe_type: Modern playbook_fields: [] product: - Splunk SOAR diff --git a/playbooks/internal_host_winrm_investigate.yml b/playbooks/internal_host_winrm_investigate.yml index 7fdc684799..911640e028 100644 --- a/playbooks/internal_host_winrm_investigate.yml +++ b/playbooks/internal_host_winrm_investigate.yml @@ -13,6 +13,7 @@ app_list: tags: platform_tags: [] playbook_type: Input + vpe_type: Modern playbook_fields: [] product: - Splunk SOAR diff --git a/playbooks/internal_host_winrm_log4j_investigate.yml b/playbooks/internal_host_winrm_log4j_investigate.yml index 6252cd96ae..ae68917be0 100644 --- a/playbooks/internal_host_winrm_log4j_investigate.yml +++ b/playbooks/internal_host_winrm_log4j_investigate.yml @@ -13,6 +13,7 @@ app_list: tags: platform_tags: [] playbook_type: Input + vpe_type: Modern playbook_fields: [] product: - Splunk SOAR diff --git a/playbooks/internal_host_winrm_log4j_respond.yml b/playbooks/internal_host_winrm_log4j_respond.yml index 8341080187..d91b9e952f 100644 --- a/playbooks/internal_host_winrm_log4j_respond.yml +++ b/playbooks/internal_host_winrm_log4j_respond.yml @@ -13,6 +13,7 @@ app_list: tags: platform_tags: [] playbook_type: Input + vpe_type: Modern playbook_fields: [] product: - Splunk SOAR diff --git a/playbooks/log4j_investigate.yml b/playbooks/log4j_investigate.yml index 940432756e..25097050bf 100644 --- a/playbooks/log4j_investigate.yml +++ b/playbooks/log4j_investigate.yml @@ -30,5 +30,6 @@ tags: - Detect Outbound LDAP Traffic playbook_fields: [] playbook_type: Automation + vpe_type: Modern product: - Splunk SOAR diff --git a/playbooks/log4j_respond.yml b/playbooks/log4j_respond.yml index 36bb6d4bf6..01bf65e624 100644 --- a/playbooks/log4j_respond.yml +++ b/playbooks/log4j_respond.yml @@ -30,5 +30,6 @@ tags: - Detect Outbound LDAP Traffic playbook_fields: [] playbook_type: Automation + vpe_type: Modern product: - Splunk SOAR diff --git a/playbooks/malware_hunt_and_contain.yml b/playbooks/malware_hunt_and_contain.yml index 8b0e78dfe3..3b97c10d52 100644 --- a/playbooks/malware_hunt_and_contain.yml +++ b/playbooks/malware_hunt_and_contain.yml @@ -16,6 +16,7 @@ app_list: tags: platform_tags: [] playbook_type: Automation + vpe_type: Classic playbook_fields: - fileHash product: diff --git a/playbooks/ransomware_investigate_and_contain.yml b/playbooks/ransomware_investigate_and_contain.yml index 13e3766a3a..c25fbc1162 100644 --- a/playbooks/ransomware_investigate_and_contain.yml +++ b/playbooks/ransomware_investigate_and_contain.yml @@ -23,6 +23,7 @@ tags: platform_tags: - Ransomware playbook_type: Automation + vpe_type: Classic playbook_fields: - ComputerName - Username diff --git a/playbooks/risk_notable_block_indicators.yml b/playbooks/risk_notable_block_indicators.yml index 2738ba26c5..ce0249f01b 100644 --- a/playbooks/risk_notable_block_indicators.yml +++ b/playbooks/risk_notable_block_indicators.yml @@ -19,6 +19,7 @@ tags: - note_title - note_content playbook_type: Automation + vpe_type: Modern platform_tags: - Risk Notable product: diff --git a/playbooks/risk_notable_enrich.yml b/playbooks/risk_notable_enrich.yml index 5d0b3aa94f..a13b96d249 100644 --- a/playbooks/risk_notable_enrich.yml +++ b/playbooks/risk_notable_enrich.yml @@ -18,6 +18,7 @@ tags: - note_title - note_content playbook_type: Automation + vpe_type: Modern platform_tags: - Risk Notable product: diff --git a/playbooks/risk_notable_import_data.yml b/playbooks/risk_notable_import_data.yml index 352f9ed240..069493612a 100644 --- a/playbooks/risk_notable_import_data.yml +++ b/playbooks/risk_notable_import_data.yml @@ -35,6 +35,7 @@ tags: platform_tags: - Risk Notable playbook_type: Automation + vpe_type: Modern playbook_fields: - event_id - info_min_time diff --git a/playbooks/risk_notable_investigate.yml b/playbooks/risk_notable_investigate.yml index cc65a769a2..f8985dbf45 100644 --- a/playbooks/risk_notable_investigate.yml +++ b/playbooks/risk_notable_investigate.yml @@ -15,6 +15,7 @@ tags: labels: - risk_notable playbook_type: Automation + vpe_type: Modern platform_tags: - Risk Notable product: diff --git a/playbooks/risk_notable_merge_events.yml b/playbooks/risk_notable_merge_events.yml index 1122af6afb..3bfbde9cc3 100644 --- a/playbooks/risk_notable_merge_events.yml +++ b/playbooks/risk_notable_merge_events.yml @@ -18,6 +18,7 @@ tags: - note_title - note_content playbook_type: Automation + vpe_type: Modern platform_tags: - Risk Notable product: diff --git a/playbooks/risk_notable_mitigate.yml b/playbooks/risk_notable_mitigate.yml index ae4e5a708c..b2da240dfc 100644 --- a/playbooks/risk_notable_mitigate.yml +++ b/playbooks/risk_notable_mitigate.yml @@ -14,6 +14,7 @@ tags: labels: - risk_notable playbook_type: Automation + vpe_type: Modern platform_tags: - Risk Notable product: diff --git a/playbooks/risk_notable_preprocess.yml b/playbooks/risk_notable_preprocess.yml index 9e86b9e3a2..8e62e3115f 100644 --- a/playbooks/risk_notable_preprocess.yml +++ b/playbooks/risk_notable_preprocess.yml @@ -21,6 +21,7 @@ tags: platform_tags: - Risk Notable playbook_type: Automation + vpe_type: Modern playbook_fields: - event_id - info_min_time diff --git a/playbooks/risk_notable_protect_assets_and_users.yml b/playbooks/risk_notable_protect_assets_and_users.yml index 135c144ff1..67587dd793 100644 --- a/playbooks/risk_notable_protect_assets_and_users.yml +++ b/playbooks/risk_notable_protect_assets_and_users.yml @@ -18,6 +18,7 @@ tags: - note_title - note_content playbook_type: Automation + vpe_type: Modern platform_tags: - Risk Notable product: diff --git a/playbooks/risk_notable_review_indicators.yml b/playbooks/risk_notable_review_indicators.yml index 0e20b770aa..02d750fe35 100644 --- a/playbooks/risk_notable_review_indicators.yml +++ b/playbooks/risk_notable_review_indicators.yml @@ -17,5 +17,6 @@ tags: platform_tags: - Risk Notable playbook_type: Automation + vpe_type: Modern product: - Splunk SOAR diff --git a/playbooks/risk_notable_verdict.yml b/playbooks/risk_notable_verdict.yml index a25d6e613f..208cf66a42 100644 --- a/playbooks/risk_notable_verdict.yml +++ b/playbooks/risk_notable_verdict.yml @@ -17,5 +17,6 @@ tags: platform_tags: - Risk Notable playbook_type: Automation + vpe_type: Modern product: - Splunk SOAR diff --git a/playbooks/start_investigation.yml b/playbooks/start_investigation.yml index 6d497d8625..1a77d56771 100644 --- a/playbooks/start_investigation.yml +++ b/playbooks/start_investigation.yml @@ -13,5 +13,6 @@ tags: platform_tags: [] playbook_fields: [] playbook_type: Automation + vpe_type: Modern product: - Splunk SOAR \ No newline at end of file diff --git a/playbooks/threat_intel_investigate.yml b/playbooks/threat_intel_investigate.yml index 918f813e98..39549a4343 100644 --- a/playbooks/threat_intel_investigate.yml +++ b/playbooks/threat_intel_investigate.yml @@ -14,6 +14,7 @@ tags: platform_tags: - threat_intel playbook_type: Automation + vpe_type: Modern playbook_fields: [] product: - Splunk SOAR \ No newline at end of file diff --git a/playbooks/trustar_enrich_indicators.yml b/playbooks/trustar_enrich_indicators.yml index 5cd35f9aa0..543c6d1bd1 100644 --- a/playbooks/trustar_enrich_indicators.yml +++ b/playbooks/trustar_enrich_indicators.yml @@ -16,6 +16,7 @@ tags: - threat_intel - risk_notable playbook_type: Input + vpe_type: Modern playbook_fields: - indicators product: