splunk-security_content/docs/_playbooks/risk_notable_preprocess.md

title, last_modified_at, toc, toc_label, tags

title	last_modified_at	toc	toc_label	tags
Risk Notable Preprocess	2021-10-22	true		Investigation Splunk SOAR Splunk Risk Notable

Try in Splunk SOAR{: .btn .btn--success}

Description

"This playbook prepares a risk notable for investigation by performing the following tasks: 1. Ensures that a risk notable links back to the original notable event with a card pinned to the HUD. 2. Posts a link to this container in the comment field of Splunk ES. 3. Updates the container name, description, and severity to reflect the data in the notable artifact."

• Type: Investigation
• Product: Splunk SOAR
• Apps: Splunk
• Last Updated: 2021-10-22
• Author: Kelby Shelton, Splunk
• ID: rn0edc96-ff2b-48b0-9f6f-13da3783fd63

Associated Detections

How To Implement

None

Playbooks

Required field

• event_id
• info_min_time
• info_max_time

Reference

• https://docs.splunk.com/Documentation/ESSOC/latest/user/Useplaybookpack

source | version: 1