mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Eric McGinnis
31 lines
1014 B
YAML
31 lines
1014 B
YAML
name: Risk Notable Preprocess
|
|
id: 060edc96-ff2b-48b0-9f6f-13da3783fd63
|
|
version: 1
|
|
date: "2021-10-22"
|
|
author: Kelby Shelton, Splunk
|
|
type: Investigation
|
|
description: >-
|
|
"This playbook prepares a risk notable for investigation by performing the following tasks:
|
|
1. Ensures that a risk notable links back to the original notable event with a card pinned to the HUD.
|
|
2. Posts a link to this container in the comment field of Splunk ES.
|
|
3. Updates the container name, description, and severity to reflect the data in the notable artifact."
|
|
playbook: risk_notable_preprocess
|
|
how_to_implement: For detailed implementation see https://docs.splunk.com/Documentation/ESSOC/latest/user/Useplaybookpack
|
|
references:
|
|
- https://docs.splunk.com/Documentation/ESSOC/latest/user/Useplaybookpack
|
|
app_list:
|
|
- "Splunk"
|
|
tags:
|
|
labels:
|
|
- risk_notable
|
|
platform_tags:
|
|
- Risk Notable
|
|
playbook_type: Automation
|
|
vpe_type: Modern
|
|
playbook_fields:
|
|
- event_id
|
|
- info_min_time
|
|
- info_max_time
|
|
product:
|
|
- Splunk SOAR
|