name: Risk Notable Preprocess
id: rn0edc96-ff2b-48b0-9f6f-13da3783fd63
version: 1
date: "2021-10-22"
author: Kelby Shelton, Splunk
type: Investigation
description: >
  "This playbook prepares a risk notable for investigation by performing the following tasks:
  1. Ensures that a risk notable links back to the original notable event with a card pinned to the HUD.
  2. Posts a link to this container in the comment field of Splunk ES.
  3. Updates the container name, description, and severity to reflect the data in the notable artifact."
playbook: risk_notable_preprocess
how_to_implement: tbd
references:
- https://docs.splunk.com/Documentation/ESSOC/latest/user/Useplaybookpack
app_list:
- "Splunk"
tags:
  labels:
  - risk_notable
  platform_tags:
  - Risk Notable
  playbook_type: Automation
  vpe_type: Modern
  playbook_fields:
  - event_id
  - info_min_time
  - info_max_time
  product:
  - Splunk SOAR