mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Lou Stella
39 lines
4.2 KiB
Markdown
39 lines
4.2 KiB
Markdown
---
|
|
title: "Playbooks"
|
|
layout: collection
|
|
author_profile: false
|
|
permalink: /playbooks/
|
|
classes: wide
|
|
sidebar:
|
|
nav: "playbooks"
|
|
---
|
|
|
|
| Name | Detections | Type |
|
|
| --------| ---------- | ----------- |
|
|
| [Active Directory Reset password](/playbooks/active_directory_reset_password/)| None | Response |
|
|
| [Block Indicators](/playbooks/block_indicators/)| None | Response |
|
|
| [Crowdstrike Malware Triage](/playbooks/crowdstrike_malware_triage/)| None | Response |
|
|
| [Delete Detected Files](/playbooks/delete_detected_files/)|[Executable File Written in Administrative SMB Share](/endpoint/executable_file_written_in_administrative_smb_share/)| Response |
|
|
| [Email Notification for Malware](/playbooks/email_notification_for_malware/)| None | Response |
|
|
| [Internal Host SSH Investigate](/playbooks/internal_host_ssh_investigate/)| None | Investigation |
|
|
| [Internal Host SSH Log4j Investigate](/playbooks/internal_host_ssh_log4j_investigate/)| None | Investigation |
|
|
| [Internal Host SSH Log4j Response](/playbooks/internal_host_ssh_log4j_response/)| None | Response |
|
|
| [Internal Host WinRM Investigate](/playbooks/internal_host_winrm_investigate/)| None | Investigation |
|
|
| [Internal Host WinRM Log4j Investigate](/playbooks/internal_host_winrm_log4j_investigate/)| None | Investigation |
|
|
| [Internal Host WinRM Response](/playbooks/internal_host_winrm_response/)| None | Investigation |
|
|
| [Log4j Investigate](/playbooks/log4j_investigate/)|[Curl Download and Bash Execution](/endpoint/curl_download_and_bash_execution/)[Wget Download and Bash Execution](/endpoint/wget_download_and_bash_execution/)[Linux Java Spawning Shell](/endpoint/linux_java_spawning_shell/)[Java Class File download by Java User Agent](/endpoint/java_class_file_download_by_java_user_agent/)[Outbound Network Connection from Java Using Default Ports](/endpoint/outbound_network_connection_from_java_using_default_ports/)[Log4Shell JNDI Payload Injection Attempt](/web/log4shell_jndi_payload_injection_attempt/)[Log4Shell JNDI Payload Injection with Outbound Connection](/web/log4shell_jndi_payload_injection_with_outbound_connection/)[Detect Outbound LDAP Traffic](/network/detect_outbound_ldap_traffic/)| Investigate |
|
|
| [Log4j Respond](/playbooks/log4j_respond/)|[Curl Download and Bash Execution](/endpoint/curl_download_and_bash_execution/)[Wget Download and Bash Execution](/endpoint/wget_download_and_bash_execution/)[Linux Java Spawning Shell](/endpoint/linux_java_spawning_shell/)[Java Class File download by Java User Agent](/endpoint/java_class_file_download_by_java_user_agent/)[Outbound Network Connection from Java Using Default Ports](/endpoint/outbound_network_connection_from_java_using_default_ports/)[Log4Shell JNDI Payload Injection Attempt](/web/log4shell_jndi_payload_injection_attempt/)[Log4Shell JNDI Payload Injection with Outbound Connection](/web/log4shell_jndi_payload_injection_with_outbound_connection/)[Detect Outbound LDAP Traffic](/network/detect_outbound_ldap_traffic/)| Response |
|
|
| [Log4j Splunk Investigation](/playbooks/log4j_splunk_investigation/)| None | Investigation |
|
|
| [Malware Hunt and Contain](/playbooks/malware_hunt_and_contain/)| None | Response |
|
|
| [Ransomware Investigate and Contain](/playbooks/ransomware_investigate_and_contain/)|[Conti Common Exec parameter](/endpoint/conti_common_exec_parameter/)| Response |
|
|
| [Risk Notable Block Indicators](/playbooks/risk_notable_block_indicators/)| None | Response |
|
|
| [Risk Notable Enrich](/playbooks/risk_notable_enrich/)| None | Investigation |
|
|
| [Risk Notable Import Data](/playbooks/risk_notable_import_data/)| None | Investigation |
|
|
| [Risk Notable Investigate](/playbooks/risk_notable_investigate/)| None | Investigation |
|
|
| [Risk Notable Merge Events](/playbooks/risk_notable_merge_events/)| None | Investigation |
|
|
| [Risk Notable Mitigate](/playbooks/risk_notable_mitigate/)| None | Response |
|
|
| [Risk Notable Preprocess](/playbooks/risk_notable_preprocess/)| None | Investigation |
|
|
| [Risk Notable Protect Assets and Users](/playbooks/risk_notable_protect_assets_and_users/)| None | Response |
|
|
| [Risk Notable Review Indicators](/playbooks/risk_notable_review_indicators/)| None | Response |
|
|
| [Risk Notable Verdict](/playbooks/risk_notable_verdict/)| None | Response |
|