splunk-security_content/docs/_playbooks/risk_notable_review_indicators.md

title, last_modified_at, toc, toc_label, tags

title	last_modified_at	toc	toc_label	tags
Risk Notable Review Indicators	2021-10-22	true		Response Splunk SOAR None

Try in Splunk SOAR{: .btn .btn--success}

Description

This playbook was designed to be called by a user to process indicators that are marked as suspicious within the SOAR platform. Analysts will review indicators in a prompt and mark them as blocked or safe.

• Type: Response
• Product: Splunk SOAR
• Apps: None
• Last Updated: 2021-10-22
• Author: Kelby Shelton, Splunk
• ID: rn0edc96-ff2b-48b0-9f6f-73da3783fd63

Associated Detections

How To Implement

Playbooks

Required field

Reference

• https://docs.splunk.com/Documentation/ESSOC/latest/user/Useplaybookpack#Indicator_tagging_system

source | version: 1