admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
develop
splunk-security_content/playbooks
T
History
ljstella c498d21841 Manual Review completion
2026-05-20 12:15:00 -04:00
..
custom_functions
SOARHELP-6700
2026-04-28 10:47:57 -04:00
Active_Directory_Disable_Account_Dispatch.json
SOARHELP-6700
2026-04-28 10:47:57 -04:00
Active_Directory_Disable_Account_Dispatch.png
Updated playbook to fix bugs
2023-07-26 09:49:51 -05:00
Active_Directory_Disable_Account_Dispatch.py
Active Directory Disable Account Dispatch tag fix
2023-08-17 13:54:45 -05:00
Active_Directory_Disable_Account_Dispatch.yml
Update playbooks to new format.
2026-05-19 11:12:49 -07:00
Active_Directory_Enable_Account_Dispatch.json
SOARHELP-6700
2026-04-28 10:47:57 -04:00
Active_Directory_Enable_Account_Dispatch.png
Resolved Bug
2023-07-13 14:35:02 -05:00
Active_Directory_Enable_Account_Dispatch.py
Resolved feedback
2023-08-14 10:41:39 -05:00
Active_Directory_Enable_Account_Dispatch.yml
Update playbooks to new format.
2026-05-19 11:12:49 -07:00
activedirectory_reset_password.json
SOARHELP-6700
2026-04-28 10:47:57 -04:00
activedirectory_reset_password.png
Adding custom functions & playbooks
2021-12-08 14:00:13 -06:00
activedirectory_reset_password.py
Adding custom functions & playbooks
2021-12-08 14:00:13 -06:00
activedirectory_reset_password.yml
Update playbooks to new format.
2026-05-19 11:12:49 -07:00
AD_LDAP_Account_Locking.json
SOARHELP-6700
2026-04-28 10:47:57 -04:00
AD_LDAP_Account_Locking.png
ad_ldap_account_locking_playbook
2023-05-17 09:44:33 +02:00
AD_LDAP_Account_Locking.py
AD LDAP Account Locking Tag Fix
2023-08-17 13:51:33 -05:00
AD_LDAP_Account_Locking.yml
Update playbooks to new format.
2026-05-19 11:12:49 -07:00
AD_LDAP_Account_Unlocking.json
SOARHELP-6700
2026-04-28 10:47:57 -04:00
AD_LDAP_Account_Unlocking.png
Created playbook
2023-06-22 10:01:16 -05:00
AD_LDAP_Account_Unlocking.py
Swap block name
2023-06-23 08:40:23 -05:00
AD_LDAP_Account_Unlocking.yml
Update playbooks to new format.
2026-05-19 11:12:49 -07:00
AD_LDAP_Entity_Attribute_Lookup.json
SOARHELP-6700
2026-04-28 10:47:57 -04:00
AD_LDAP_Entity_Attribute_Lookup.png
AD LDAP Entity Attributes Lookup playbook
2023-03-06 10:57:09 -06:00
AD_LDAP_Entity_Attribute_Lookup.py
AD LDAP Entity Attributes Lookup playbook
2023-03-06 10:57:09 -06:00
AD_LDAP_Entity_Attribute_Lookup.yml
Update playbooks to new format.
2026-05-19 11:12:49 -07:00
Attribute_Lookup_Dispatch.json
SOARHELP-6700
2026-04-28 10:47:57 -04:00
Attribute_Lookup_Dispatch.png
Moved dispatch to end of playbook name
2023-04-12 12:29:59 -05:00
Attribute_Lookup_Dispatch.py
Moved dispatch to end of playbook name
2023-04-12 12:29:59 -05:00
Attribute_Lookup_Dispatch.yml
Update playbooks to new format.
2026-05-19 11:12:49 -07:00
Automated_Enrichment.json
SOARHELP-6700
2026-04-28 10:47:57 -04:00
Automated_Enrichment.png
Fixed automated enrichment to reference renamed playbooks
2023-09-08 14:20:10 -05:00
Automated_Enrichment.py
Fixed automated enrichment to reference renamed playbooks
2023-09-08 14:20:10 -05:00
Automated_Enrichment.yml
Update playbooks to new format.
2026-05-19 11:12:49 -07:00
aws_disable_user_accounts.json
SOARHELP-6700
2026-04-28 10:47:57 -04:00
aws_disable_user_accounts.png
AWS Disable User Accounts
2022-02-02 12:13:00 -06:00
aws_disable_user_accounts.py
AWS Disable User Accounts
2022-02-02 12:13:00 -06:00
aws_disable_user_accounts.yml
Update playbooks to new format.
2026-05-19 11:12:49 -07:00
aws_find_inactive_users.json
SOARHELP-6700
2026-04-28 10:47:57 -04:00
aws_find_inactive_users.png
AWS Find Inactive Users
2022-02-01 16:03:04 -06:00
aws_find_inactive_users.py
AWS Find Inactive Users
2022-02-01 16:03:04 -06:00
aws_find_inactive_users.yml
Update playbooks to new format.
2026-05-19 11:12:49 -07:00
AWS_IAM_Account_Locking.json
SOARHELP-6700
2026-04-28 10:47:57 -04:00
AWS_IAM_Account_Locking.png
AWS_IAM_Account_Locking_Playbook
2023-05-10 09:40:42 +02:00
AWS_IAM_Account_Locking.py
AWS_IAM_Account_Locking_Playbook
2023-05-25 10:33:05 +02:00
AWS_IAM_Account_Locking.yml
Update playbooks to new format.
2026-05-19 11:12:49 -07:00
AWS_IAM_Account_Unlocking.json
SOARHELP-6700
2026-04-28 10:47:57 -04:00
AWS_IAM_Account_Unlocking.png
Created playbook
2023-06-22 10:50:06 -05:00
AWS_IAM_Account_Unlocking.py
Resolved feedback
2023-08-14 10:13:54 -05:00
AWS_IAM_Account_Unlocking.yml
Update playbooks to new format.
2026-05-19 11:12:49 -07:00
Azure_AD_Account_Locking.json
SOARHELP-6700
2026-04-28 10:47:57 -04:00
Azure_AD_Account_Locking.png
Azure_AD_Locking_Playbook
2023-05-25 10:39:23 +02:00
Azure_AD_Account_Locking.py
Azure AD Account Locking tag fix
2023-08-17 13:53:31 -05:00
Azure_AD_Account_Locking.yml
Update playbooks to new format.
2026-05-19 11:12:49 -07:00
Azure_AD_Account_Unlocking.json
SOARHELP-6700
2026-04-28 10:47:57 -04:00
Azure_AD_Account_Unlocking.png
Resolved feedback
2023-08-14 10:30:52 -05:00
Azure_AD_Account_Unlocking.py
Resolved feedback
2023-08-14 10:30:52 -05:00
Azure_AD_Account_Unlocking.yml
Update playbooks to new format.
2026-05-19 11:12:49 -07:00
Azure_AD_Graph_User_Attribute_Lookup.json
SOARHELP-6700
2026-04-28 10:47:57 -04:00
Azure_AD_Graph_User_Attribute_Lookup.png
Azure AD Graph User Attribute Lookup Playbook
2023-03-06 10:57:30 -06:00
Azure_AD_Graph_User_Attribute_Lookup.py
Azure AD Graph User Attribute Lookup Playbook
2023-03-06 10:57:30 -06:00
Azure_AD_Graph_User_Attribute_Lookup.yml
Update playbooks to new format.
2026-05-19 11:12:49 -07:00
block_indicators.json
Added block_indicators playbook
2022-01-05 12:17:54 -06:00
block_indicators.png
Added block_indicators playbook
2022-01-05 12:17:54 -06:00
block_indicators.py
Added block_indicators playbook
2022-01-05 12:17:54 -06:00
block_indicators.yml
Update playbooks to new format.
2026-05-19 11:12:49 -07:00
Cisco_Umbrella_DNS_Denylisting.json
SOARHELP-6700
2026-04-28 10:47:57 -04:00
Cisco_Umbrella_DNS_Denylisting.png
update screenshot
2023-08-02 14:20:50 +02:00
Cisco_Umbrella_DNS_Denylisting.py
bug fix
2023-08-02 13:37:13 +02:00
Cisco_Umbrella_DNS_Denylisting.yml
Update playbooks to new format.
2026-05-19 11:12:49 -07:00
CiscoTalosIntelligence_Identifier_Reputation_Analysis.json
Complete porinting of playbooks. Fix references to old, removed detections
2026-05-19 14:28:53 -07:00
CiscoTalosIntelligence_Identifier_Reputation_Analysis.png
Renaming file again, maybe this won't break
2025-01-30 09:15:53 -06:00
CiscoTalosIntelligence_Identifier_Reputation_Analysis.py
Complete porinting of playbooks. Fix references to old, removed detections
2026-05-19 14:28:53 -07:00
CiscoTalosIntelligence_Identifier_Reputation_Analysis.yml
Manual Review completion
2026-05-20 12:15:00 -04:00
crowdstrike_malware_triage.json
SOARHELP-6700
2026-04-28 10:47:57 -04:00
crowdstrike_malware_triage.png
Adding custom functions & playbooks
2021-12-08 14:00:13 -06:00
crowdstrike_malware_triage.py
Adding custom functions & playbooks
2021-12-08 14:00:13 -06:00
crowdstrike_malware_triage.yml
Update playbooks to new format.
2026-05-19 11:12:49 -07:00
CrowdStrike_OAuth_API_Device_Attribute_Lookup.json
SOARHELP-6700
2026-04-28 10:47:57 -04:00
CrowdStrike_OAuth_API_Device_Attribute_Lookup.png
Crowdstrike OAuth API Device Attribute Lookup playbook
2023-03-06 10:57:59 -06:00
CrowdStrike_OAuth_API_Device_Attribute_Lookup.py
Crowdstrike OAuth API Device Attribute Lookup playbook
2023-03-06 10:57:59 -06:00
CrowdStrike_OAuth_API_Device_Attribute_Lookup.yml
Update playbooks to new format.
2026-05-19 11:12:49 -07:00
CrowdStrike_OAuth_API_Dynamic_Analysis.json
SOARHELP-6700
2026-04-28 10:47:57 -04:00
CrowdStrike_OAuth_API_Dynamic_Analysis.png
crowdstrike_oauth_api_playbook_v2
2023-03-30 11:36:37 +02:00
CrowdStrike_OAuth_API_Dynamic_Analysis.py
crowdstrike_oauth_api_playbook_v2
2023-04-13 16:38:22 +02:00
CrowdStrike_OAuth_API_Dynamic_Analysis.yml
Update playbooks to new format.
2026-05-19 11:12:49 -07:00
CrowdStrike_OAuth_API_Endpoint_Analysis.json
SOARHELP-6700
2026-04-28 10:47:57 -04:00
CrowdStrike_OAuth_API_Endpoint_Analysis.png
Added Playbooks from the CrowdStrike EDR Pack
2025-06-20 11:42:52 -04:00
CrowdStrike_OAuth_API_Endpoint_Analysis.py
Added Playbooks from the CrowdStrike EDR Pack
2025-06-20 11:42:52 -04:00
CrowdStrike_OAuth_API_Endpoint_Analysis.yml
Update playbooks to new format.
2026-05-19 11:12:49 -07:00
CrowdStrike_OAuth_API_Executable_Denylisting.json
SOARHELP-6700
2026-04-28 10:47:57 -04:00
CrowdStrike_OAuth_API_Executable_Denylisting.png
Added Playbooks from the CrowdStrike EDR Pack
2025-06-20 11:42:52 -04:00
CrowdStrike_OAuth_API_Executable_Denylisting.py
Added Playbooks from the CrowdStrike EDR Pack
2025-06-20 11:42:52 -04:00
CrowdStrike_OAuth_API_Executable_Denylisting.yml
Update playbooks to new format.
2026-05-19 11:12:49 -07:00
CrowdStrike_OAuth_API_File_Collection.json
SOARHELP-6700
2026-04-28 10:47:57 -04:00
CrowdStrike_OAuth_API_File_Collection.png
Added Playbooks from the CrowdStrike EDR Pack
2025-06-20 11:42:52 -04:00
CrowdStrike_OAuth_API_File_Collection.py
Added Playbooks from the CrowdStrike EDR Pack
2025-06-20 11:42:52 -04:00
CrowdStrike_OAuth_API_File_Collection.yml
Update playbooks to new format.
2026-05-19 11:12:49 -07:00
CrowdStrike_OAuth_API_File_Eviction.json
SOARHELP-6700
2026-04-28 10:47:57 -04:00
CrowdStrike_OAuth_API_File_Eviction.png
Added Playbooks from the CrowdStrike EDR Pack
2025-06-20 11:42:52 -04:00
CrowdStrike_OAuth_API_File_Eviction.py
Added Playbooks from the CrowdStrike EDR Pack
2025-06-20 11:42:52 -04:00
CrowdStrike_OAuth_API_File_Eviction.yml
Update playbooks to new format.
2026-05-19 11:12:49 -07:00
CrowdStrike_OAuth_API_File_Restore.json
SOARHELP-6700
2026-04-28 10:47:57 -04:00
CrowdStrike_OAuth_API_File_Restore.png
Added Playbooks from the CrowdStrike EDR Pack
2025-06-20 11:42:52 -04:00
CrowdStrike_OAuth_API_File_Restore.py
Added Playbooks from the CrowdStrike EDR Pack
2025-06-20 11:42:52 -04:00
CrowdStrike_OAuth_API_File_Restore.yml
Update playbooks to new format.
2026-05-19 11:12:49 -07:00
CrowdStrike_OAuth_API_Get_Device_Info.json
SOARHELP-6700
2026-04-28 10:47:57 -04:00
CrowdStrike_OAuth_API_Get_Device_Info.png
Added Playbooks from the CrowdStrike EDR Pack
2025-06-20 11:42:52 -04:00
CrowdStrike_OAuth_API_Get_Device_Info.py
Added Playbooks from the CrowdStrike EDR Pack
2025-06-20 11:42:52 -04:00
CrowdStrike_OAuth_API_Get_Device_Info.yml
Update playbooks to new format.
2026-05-19 11:12:49 -07:00
CrowdStrike_OAuth_API_Identifier_Activity_Analysis.json
SOARHELP-6700
2026-04-28 10:47:57 -04:00
CrowdStrike_OAuth_API_Identifier_Activity_Analysis.png
Initial Commit- CrowdStrike OAuth API Identifier Activity Analysis
2023-03-30 17:41:14 -05:00
CrowdStrike_OAuth_API_Identifier_Activity_Analysis.py
Addressed Kelby's points
2023-05-04 13:55:12 -05:00
CrowdStrike_OAuth_API_Identifier_Activity_Analysis.yml
Update playbooks to new format.
2026-05-19 11:12:49 -07:00
CrowdStrike_OAuth_API_Network_Isolation.json
SOARHELP-6700
2026-04-28 10:47:57 -04:00
CrowdStrike_OAuth_API_Network_Isolation.png
Added Playbooks from the CrowdStrike EDR Pack
2025-06-20 11:42:52 -04:00
CrowdStrike_OAuth_API_Network_Isolation.py
Added Playbooks from the CrowdStrike EDR Pack
2025-06-20 11:42:52 -04:00
CrowdStrike_OAuth_API_Network_Isolation.yml
Update playbooks to new format.
2026-05-19 11:12:49 -07:00
CrowdStrike_OAuth_API_Network_Restore.json
SOARHELP-6700
2026-04-28 10:47:57 -04:00
CrowdStrike_OAuth_API_Network_Restore.png
Added Playbooks from the CrowdStrike EDR Pack
2025-06-20 11:42:52 -04:00
CrowdStrike_OAuth_API_Network_Restore.py
Added Playbooks from the CrowdStrike EDR Pack
2025-06-20 11:42:52 -04:00
CrowdStrike_OAuth_API_Network_Restore.yml
Update playbooks to new format.
2026-05-19 11:12:49 -07:00
CrowdStrike_OAuth_API_Process_Termination.json
SOARHELP-6700
2026-04-28 10:47:57 -04:00
CrowdStrike_OAuth_API_Process_Termination.png
Added Playbooks from the CrowdStrike EDR Pack
2025-06-20 11:42:52 -04:00
CrowdStrike_OAuth_API_Process_Termination.py
Added Playbooks from the CrowdStrike EDR Pack
2025-06-20 11:42:52 -04:00
CrowdStrike_OAuth_API_Process_Termination.yml
Update playbooks to new format.
2026-05-19 11:12:49 -07:00
delete_detected_files.json
SOARHELP-6700
2026-04-28 10:47:57 -04:00
delete_detected_files.png
Adding custom functions & playbooks
2021-12-08 14:00:13 -06:00
delete_detected_files.py
Adding custom functions & playbooks
2021-12-08 14:00:13 -06:00
delete_detected_files.yml
Update playbooks to new format.
2026-05-19 11:12:49 -07:00
DNS_Denylisting_Dispatch.json
SOARHELP-6700
2026-04-28 10:47:57 -04:00
DNS_Denylisting_Dispatch.png
bug fix
2023-08-02 14:18:34 +02:00
DNS_Denylisting_Dispatch.py
bug fix
2023-08-02 14:18:34 +02:00
DNS_Denylisting_Dispatch.yml
Update playbooks to new format.
2026-05-19 11:12:49 -07:00
Dynamic_Analysis_Dispatch.json
SOARHELP-6700
2026-04-28 10:47:57 -04:00
Dynamic_Analysis_Dispatch.png
Made required changes. See description.
2023-04-29 16:43:09 -05:00
Dynamic_Analysis_Dispatch.py
Fixed reference to different playbook.
2023-04-29 16:56:39 -05:00
Dynamic_Analysis_Dispatch.yml
Update playbooks to new format.
2026-05-19 11:12:49 -07:00
email_notification_for_malware.json
SOARHELP-6700
2026-04-28 10:47:57 -04:00
email_notification_for_malware.png
Added email notification for malware playbook
2022-01-05 13:28:38 -06:00
email_notification_for_malware.py
Added email notification for malware playbook
2022-01-05 13:28:38 -06:00
email_notification_for_malware.yml
Update playbooks to new format.
2026-05-19 11:12:49 -07:00
G_Suite_for_Gmail_Message_Eviction.json
SOARHELP-6700
2026-04-28 10:47:57 -04:00
G_Suite_for_Gmail_Message_Eviction.png
ESCU v4.26.0 Release branch
2024-03-06 19:30:20 +00:00
G_Suite_for_Gmail_Message_Eviction.py
ESCU v4.26.0 Release branch
2024-03-06 19:30:20 +00:00
G_Suite_for_Gmail_Message_Eviction.yml
Update playbooks to new format.
2026-05-19 11:12:49 -07:00
G_Suite_for_GMail_Message_Identifier_Activity_Analysis.json
SOARHELP-6700
2026-04-28 10:47:57 -04:00
G_Suite_for_GMail_Message_Identifier_Activity_Analysis.png
Updated to remove non-results
2023-05-23 10:11:01 -05:00
G_Suite_for_GMail_Message_Identifier_Activity_Analysis.py
ESCU v4.26.0 Release branch
2024-03-06 19:30:20 +00:00
G_Suite_for_GMail_Message_Identifier_Activity_Analysis.yml
Update playbooks to new format.
2026-05-19 11:12:49 -07:00
G_Suite_for_Gmail_Search_and_Purge.json
SOARHELP-6700
2026-04-28 10:47:57 -04:00
G_Suite_for_Gmail_Search_and_Purge.png
ESCU v4.26.0 Release branch
2024-03-06 19:30:20 +00:00
G_Suite_for_Gmail_Search_and_Purge.py
ESCU v4.26.0 Release branch
2024-03-06 19:30:20 +00:00
G_Suite_for_Gmail_Search_and_Purge.yml
Update playbooks to new format.
2026-05-19 11:12:49 -07:00
hunting.json
Adding hunting playbook
2022-07-29 17:12:35 -05:00
hunting.png
Adding hunting playbook
2022-07-29 17:12:35 -05:00
hunting.py
Adding hunting playbook
2022-07-29 17:12:35 -05:00
hunting.yml
Update playbooks to new format.
2026-05-19 11:12:49 -07:00
Identifier_Activity_Analysis_Dispatch.json
SOARHELP-6700
2026-04-28 10:47:57 -04:00
Identifier_Activity_Analysis_Dispatch.png
Identifier Activity Analysis Dispatch
2023-04-10 17:09:41 -05:00
Identifier_Activity_Analysis_Dispatch.py
Last style update
2023-05-19 08:58:05 -05:00
Identifier_Activity_Analysis_Dispatch.yml
Update playbooks to new format.
2026-05-19 11:12:49 -07:00
Identifier_Reputation_Analysis_Dispatch.json
SOARHELP-6700
2026-04-28 10:47:57 -04:00
Identifier_Reputation_Analysis_Dispatch.png
Moved dispatch to end of playbook name
2023-04-12 12:29:59 -05:00
Identifier_Reputation_Analysis_Dispatch.py
Moved dispatch to end of playbook name
2023-04-12 12:29:59 -05:00
Identifier_Reputation_Analysis_Dispatch.yml
Update playbooks to new format.
2026-05-19 11:12:49 -07:00
internal_host_splunk_investigate_log4j.json
SOARHELP-6700
2026-04-28 10:47:57 -04:00
internal_host_splunk_investigate_log4j.png
Final copy from phantomcyber/playbooks
2021-12-15 16:58:31 -06:00
internal_host_splunk_investigate_log4j.py
Final copy from phantomcyber/playbooks
2021-12-15 16:58:31 -06:00
internal_host_splunk_investigate_log4j.yml
Update playbooks to new format.
2026-05-19 11:12:49 -07:00
internal_host_ssh_investigate.json
SOARHELP-6700
2026-04-28 10:47:57 -04:00
internal_host_ssh_investigate.png
Final copy from phantomcyber/playbooks
2021-12-15 16:58:31 -06:00
internal_host_ssh_investigate.py
Final copy from phantomcyber/playbooks
2021-12-15 16:58:31 -06:00
internal_host_ssh_investigate.yml
Update playbooks to new format.
2026-05-19 11:12:49 -07:00
internal_host_ssh_log4j_investigate.json
SOARHELP-6700
2026-04-28 10:47:57 -04:00
internal_host_ssh_log4j_investigate.png
... and another one
2021-12-14 18:59:22 -06:00
internal_host_ssh_log4j_investigate.py
Final copy from phantomcyber/playbooks
2021-12-15 16:58:31 -06:00
internal_host_ssh_log4j_investigate.yml
Update playbooks to new format.
2026-05-19 11:12:49 -07:00
internal_host_ssh_log4j_respond.json
SOARHELP-6700
2026-04-28 10:47:57 -04:00
internal_host_ssh_log4j_respond.png
Final copy from phantomcyber/playbooks
2021-12-15 16:58:31 -06:00
internal_host_ssh_log4j_respond.py
Final copy from phantomcyber/playbooks
2021-12-15 16:58:31 -06:00
internal_host_ssh_log4j_respond.yml
Update playbooks to new format.
2026-05-19 11:12:49 -07:00
internal_host_winrm_investigate.json
SOARHELP-6700
2026-04-28 10:47:57 -04:00
internal_host_winrm_investigate.png
Some playbooks
2021-12-14 18:34:37 -06:00
internal_host_winrm_investigate.py
Final copy from phantomcyber/playbooks
2021-12-15 16:58:31 -06:00
internal_host_winrm_investigate.yml
Update playbooks to new format.
2026-05-19 11:12:49 -07:00
internal_host_winrm_log4j_investigate.json
SOARHELP-6700
2026-04-28 10:47:57 -04:00
internal_host_winrm_log4j_investigate.png
Some playbooks
2021-12-14 18:34:37 -06:00
internal_host_winrm_log4j_investigate.py
Final copy from phantomcyber/playbooks
2021-12-15 16:58:31 -06:00
internal_host_winrm_log4j_investigate.yml
Update playbooks to new format.
2026-05-19 11:12:49 -07:00
internal_host_winrm_log4j_respond.json
SOARHELP-6700
2026-04-28 10:47:57 -04:00
internal_host_winrm_log4j_respond.png
Some playbooks
2021-12-14 18:34:37 -06:00
internal_host_winrm_log4j_respond.py
Final copy from phantomcyber/playbooks
2021-12-15 16:58:31 -06:00
internal_host_winrm_log4j_respond.yml
Update playbooks to new format.
2026-05-19 11:12:49 -07:00
Jira_Related_Tickets_Search.json
SOARHELP-6700
2026-04-28 10:47:57 -04:00
Jira_Related_Tickets_Search.png
Add playbook Jira_Related_Tickets_Search
2023-08-09 16:46:38 -07:00
Jira_Related_Tickets_Search.py
Update playbook to fix None assignee and support dispatch playbook
2023-08-23 14:20:20 -07:00
Jira_Related_Tickets_Search.yml
Update playbooks to new format.
2026-05-19 11:12:49 -07:00
log4j_investigate.json
SOARHELP-6700
2026-04-28 10:47:57 -04:00
log4j_investigate.png
divorced parent playbook
2021-12-15 15:03:21 -06:00
log4j_investigate.py
Final copy from phantomcyber/playbooks
2021-12-15 16:58:31 -06:00
log4j_investigate.yml
Manual Review completion
2026-05-20 12:15:00 -04:00
log4j_respond.json
SOARHELP-6700
2026-04-28 10:47:57 -04:00
log4j_respond.png
divorced parent playbook
2021-12-15 15:03:21 -06:00
log4j_respond.py
Final copy from phantomcyber/playbooks
2021-12-15 16:58:31 -06:00
log4j_respond.yml
Manual Review completion
2026-05-20 12:15:00 -04:00
malware_hunt_and_contain.json
Added malware hunt and contain playbook
2022-01-05 13:41:59 -06:00
malware_hunt_and_contain.png
Added malware hunt and contain playbook
2022-01-05 13:41:59 -06:00
malware_hunt_and_contain.py
Added malware hunt and contain playbook
2022-01-05 13:41:59 -06:00
malware_hunt_and_contain.yml
Update playbooks to new format.
2026-05-19 11:12:49 -07:00
MS_Graph_for_Office_365_Message_Eviction.json
SOARHELP-6700
2026-04-28 10:47:57 -04:00
MS_Graph_for_Office_365_Message_Eviction.png
ESCU v4.26.0 Release branch
2024-03-06 19:30:20 +00:00
MS_Graph_for_Office_365_Message_Eviction.py
ESCU v4.26.0 Release branch
2024-03-06 19:30:20 +00:00
MS_Graph_for_Office_365_Message_Eviction.yml
Update playbooks to new format.
2026-05-19 11:12:49 -07:00
MS_Graph_for_Office_365_Message_Identifier_Activity_Analysis.json
SOARHELP-6700
2026-04-28 10:47:57 -04:00
MS_Graph_for_Office_365_Message_Identifier_Activity_Analysis.png
ESCU v4.26.0 Release branch
2024-03-06 19:30:20 +00:00
MS_Graph_for_Office_365_Message_Identifier_Activity_Analysis.py
ESCU v4.26.0 Release branch
2024-03-06 19:30:20 +00:00
MS_Graph_for_Office_365_Message_Identifier_Activity_Analysis.yml
Update playbooks to new format.
2026-05-19 11:12:49 -07:00
MS_Graph_for_Office_365_Message_Restore.json
SOARHELP-6700
2026-04-28 10:47:57 -04:00
MS_Graph_for_Office_365_Message_Restore.png
ESCU v4.26.0 Release branch
2024-03-06 19:30:20 +00:00
MS_Graph_for_Office_365_Message_Restore.py
ESCU v4.26.0 Release branch
2024-03-06 19:30:20 +00:00
MS_Graph_for_Office_365_Message_Restore.yml
Update playbooks to new format.
2026-05-19 11:12:49 -07:00
MS_Graph_for_Office_365_Search_and_Purge.json
SOARHELP-6700
2026-04-28 10:47:57 -04:00
MS_Graph_for_Office_365_Search_and_Purge.png
ESCU v4.26.0 Release branch
2024-03-06 19:30:20 +00:00
MS_Graph_for_Office_365_Search_and_Purge.py
ESCU v4.26.0 Release branch
2024-03-06 19:30:20 +00:00
MS_Graph_for_Office_365_Search_and_Purge.yml
Update playbooks to new format.
2026-05-19 11:12:49 -07:00
MS_Graph_for_Office_365_Search_and_Restore.json
SOARHELP-6700
2026-04-28 10:47:57 -04:00
MS_Graph_for_Office_365_Search_and_Restore.png
ESCU v4.26.0 Release branch
2024-03-06 19:30:20 +00:00
MS_Graph_for_Office_365_Search_and_Restore.py
ESCU v4.26.0 Release branch
2024-03-06 19:30:20 +00:00
MS_Graph_for_Office_365_Search_and_Restore.yml
Update playbooks to new format.
2026-05-19 11:12:49 -07:00
Panorama_Outbound_Traffic_Filtering.json
SOARHELP-6700
2026-04-28 10:47:57 -04:00
Panorama_Outbound_Traffic_Filtering.png
Fixed based on the given feedback
2023-06-21 11:59:22 +02:00
Panorama_Outbound_Traffic_Filtering.py
Fixed based on the given feedback
2023-06-21 11:59:22 +02:00
Panorama_Outbound_Traffic_Filtering.yml
Update playbooks to new format.
2026-05-19 11:12:49 -07:00
PhishTank_URL_Reputation_Analysis.json
SOARHELP-6700
2026-04-28 10:47:57 -04:00
PhishTank_URL_Reputation_Analysis.png
new SOAR content
2023-01-11 11:08:28 -06:00
PhishTank_URL_Reputation_Analysis.py
new SOAR content
2023-01-11 11:08:28 -06:00
PhishTank_URL_Reputation_Analysis.yml
Update playbooks to new format.
2026-05-19 11:12:49 -07:00
ransomware_investigate_and_contain.json
SOARHELP-6700
2026-04-28 10:47:57 -04:00
ransomware_investigate_and_contain.png
Added demo playbook for development
2021-09-16 10:21:27 -05:00
ransomware_investigate_and_contain.py
Added demo playbook for development
2021-09-16 10:21:27 -05:00
ransomware_investigate_and_contain.yml
Update playbooks to new format.
2026-05-19 11:12:49 -07:00
Related_Tickets_Search_Dispatch.json
SOARHELP-6700
2026-04-28 10:47:57 -04:00
Related_Tickets_Search_Dispatch.png
Moved dispatch to end of playbook name
2023-04-12 12:29:59 -05:00
Related_Tickets_Search_Dispatch.py
Moved dispatch to end of playbook name
2023-04-12 12:29:59 -05:00
Related_Tickets_Search_Dispatch.yml
Update playbooks to new format.
2026-05-19 11:12:49 -07:00
risk_notable_block_indicators.json
SOARHELP-6700
2026-04-28 10:47:57 -04:00
risk_notable_block_indicators.png
Initial commit
2021-11-10 09:25:44 -06:00
risk_notable_block_indicators.py
SOARHELP-6700
2026-04-28 10:47:57 -04:00
risk_notable_block_indicators.yml
Update playbooks to new format.
2026-05-19 11:12:49 -07:00
risk_notable_enrich.json
SOARHELP-6700
2026-04-28 10:47:57 -04:00
risk_notable_enrich.png
Initial commit
2021-11-10 09:25:44 -06:00
risk_notable_enrich.py
Updating playbooks
2022-01-18 15:12:03 -06:00
risk_notable_enrich.yml
Update playbooks to new format.
2026-05-19 11:12:49 -07:00
risk_notable_import_data.json
SOARHELP-6700
2026-04-28 10:47:57 -04:00
risk_notable_import_data.png
Initial commit
2021-11-10 09:25:44 -06:00
risk_notable_import_data.py
SOARHELP-6700
2026-04-28 10:47:57 -04:00
risk_notable_import_data.yml
Update playbooks to new format.
2026-05-19 11:12:49 -07:00
risk_notable_investigate.json
SOARHELP-6700
2026-04-28 10:47:57 -04:00
risk_notable_investigate.png
Initial commit
2021-11-10 09:25:44 -06:00
risk_notable_investigate.py
Initial commit
2021-11-10 09:25:44 -06:00
risk_notable_investigate.yml
Update playbooks to new format.
2026-05-19 11:12:49 -07:00
risk_notable_merge_events.json
SOARHELP-6700
2026-04-28 10:47:57 -04:00
risk_notable_merge_events.png
Initial commit
2021-11-10 09:25:44 -06:00
risk_notable_merge_events.py
SOARHELP-6700
2026-04-28 10:47:57 -04:00
risk_notable_merge_events.yml
Update playbooks to new format.
2026-05-19 11:12:49 -07:00
risk_notable_mitigate.json
SOARHELP-6700
2026-04-28 10:47:57 -04:00
risk_notable_mitigate.png
Initial commit
2021-11-10 09:25:44 -06:00
risk_notable_mitigate.py
Initial commit
2021-11-10 09:25:44 -06:00
risk_notable_mitigate.yml
Update playbooks to new format.
2026-05-19 11:12:49 -07:00
risk_notable_preprocess.json
SOARHELP-6700
2026-04-28 10:47:57 -04:00
risk_notable_preprocess.png
Initial commit
2021-11-10 09:25:44 -06:00
risk_notable_preprocess.py
SOARHELP-6700
2026-04-28 10:47:57 -04:00
risk_notable_preprocess.yml
Update playbooks to new format.
2026-05-19 11:12:49 -07:00
risk_notable_protect_assets_and_users.json
SOARHELP-6700
2026-04-28 10:47:57 -04:00
risk_notable_protect_assets_and_users.png
Initial commit
2021-11-10 09:25:44 -06:00
risk_notable_protect_assets_and_users.py
SOARHELP-6700
2026-04-28 10:47:57 -04:00
risk_notable_protect_assets_and_users.yml
Update playbooks to new format.
2026-05-19 11:12:49 -07:00
risk_notable_review_indicators.json
SOARHELP-6700
2026-04-28 10:47:57 -04:00
risk_notable_review_indicators.png
Initial commit
2021-11-10 09:25:44 -06:00
risk_notable_review_indicators.py
Initial commit
2021-11-10 09:25:44 -06:00
risk_notable_review_indicators.yml
Update playbooks to new format.
2026-05-19 11:12:49 -07:00
risk_notable_verdict.json
SOARHELP-6700
2026-04-28 10:47:57 -04:00
risk_notable_verdict.png
Initial commit
2021-11-10 09:25:44 -06:00
risk_notable_verdict.py
Updating playbooks
2022-01-18 15:12:03 -06:00
risk_notable_verdict.yml
Update playbooks to new format.
2026-05-19 11:12:49 -07:00
ServiceNow_Related_Tickets_Search.json
SOARHELP-6700
2026-04-28 10:47:57 -04:00
ServiceNow_Related_Tickets_Search.png
Copy content from phantomcyber/playbooks
2023-02-27 16:40:38 -06:00
ServiceNow_Related_Tickets_Search.py
SOARHELP-6700
2026-04-28 10:47:57 -04:00
ServiceNow_Related_Tickets_Search.yml
Update playbooks to new format.
2026-05-19 11:12:49 -07:00
Splunk_Attack_Analyzer_Dynamic_Analysis.json
SOARHELP-6700
2026-04-28 10:47:57 -04:00
Splunk_Attack_Analyzer_Dynamic_Analysis.png
SOARHELP-6700
2026-04-28 10:47:57 -04:00
Splunk_Attack_Analyzer_Dynamic_Analysis.py
SOARHELP-6700
2026-04-28 10:47:57 -04:00
Splunk_Attack_Analyzer_Dynamic_Analysis.yml
Update playbooks to new format.
2026-05-19 11:12:49 -07:00
Splunk_Automated_Email_Investigation.json
SOARHELP-6700
2026-04-28 10:47:57 -04:00
Splunk_Automated_Email_Investigation.png
SOARHELP-6700
2026-04-28 10:47:57 -04:00
Splunk_Automated_Email_Investigation.py
Release Branch ESCU 4.23.0
2024-01-30 20:52:05 +00:00
Splunk_Automated_Email_Investigation.yml
Update playbooks to new format.
2026-05-19 11:12:49 -07:00
Splunk_Identifier_Activity_Analysis.json
SOARHELP-6700
2026-04-28 10:47:57 -04:00
Splunk_Identifier_Activity_Analysis.png
SOARHELP-6700
2026-04-28 10:47:57 -04:00
Splunk_Identifier_Activity_Analysis.py
Release Branch ESCU 4.23.0
2024-01-30 20:52:05 +00:00
Splunk_Identifier_Activity_Analysis.yml
Update playbooks to new format.
2026-05-19 11:12:49 -07:00
Splunk_Message_Identifier_Activity_Analysis.json
SOARHELP-6700
2026-04-28 10:47:57 -04:00
Splunk_Message_Identifier_Activity_Analysis.png
SOARHELP-6700
2026-04-28 10:47:57 -04:00
Splunk_Message_Identifier_Activity_Analysis.py
Release Branch ESCU 4.23.0
2024-01-30 20:52:05 +00:00
Splunk_Message_Identifier_Activity_Analysis.yml
Update playbooks to new format.
2026-05-19 11:12:49 -07:00
Splunk_Notable_Related_Tickets_Search.json
SOARHELP-6700
2026-04-28 10:47:57 -04:00
Splunk_Notable_Related_Tickets_Search.png
Updating to keep in sync w/ phantomcyber/playbooks
2023-03-03 15:35:25 -06:00
Splunk_Notable_Related_Tickets_Search.py
Updating to keep in sync w/ phantomcyber/playbooks
2023-03-03 15:35:25 -06:00
Splunk_Notable_Related_Tickets_Search.yml
Update playbooks to new format.
2026-05-19 11:12:49 -07:00
start_investigation.json
SOARHELP-6700
2026-04-28 10:47:57 -04:00
start_investigation.png
Start Investigation
2022-02-02 15:32:59 -06:00
start_investigation.py
SOARHELP-6700
2026-04-28 10:47:57 -04:00
start_investigation.yml
Update playbooks to new format.
2026-05-19 11:12:49 -07:00
threat_intel_investigate.json
SOARHELP-6700
2026-04-28 10:47:57 -04:00
threat_intel_investigate.png
Threat Intel Investigate
2022-02-02 13:24:37 -06:00
threat_intel_investigate.py
Threat Intel Investigate
2022-02-02 13:24:37 -06:00
threat_intel_investigate.yml
Update playbooks to new format.
2026-05-19 11:12:49 -07:00
trustar_enrich_indicators.json
TruSTAR Enrich Indicators
2022-02-02 12:44:35 -06:00
trustar_enrich_indicators.png
TruSTAR Enrich Indicators
2022-02-02 12:44:35 -06:00
trustar_enrich_indicators.py
TruSTAR Enrich Indicators
2022-02-02 12:44:35 -06:00
trustar_enrich_indicators.yml
Update playbooks to new format.
2026-05-19 11:12:49 -07:00
URL_Outbound_Traffic_Filtering_Dispatch.json
SOARHELP-6700
2026-04-28 10:47:57 -04:00
URL_Outbound_Traffic_Filtering_Dispatch.png
URL Outbound Traffic Filtering Dispatch Playbook
2023-05-22 12:23:08 +02:00
URL_Outbound_Traffic_Filtering_Dispatch.py
URL Outbound Traffic Filtering Dispatch Playbook
2023-05-22 12:23:08 +02:00
URL_Outbound_Traffic_Filtering_Dispatch.yml
Update playbooks to new format.
2026-05-19 11:12:49 -07:00
UrlScan_IO_Dynamic_Analysis.json
SOARHELP-6700
2026-04-28 10:47:57 -04:00
UrlScan_IO_Dynamic_Analysis.png
urlscan_io_dynamic_analysis_playbook
2023-03-23 11:41:42 +01:00
UrlScan_IO_Dynamic_Analysis.py
minor_update_saa_urlscan_playbook
2023-04-05 19:19:19 +02:00
UrlScan_IO_Dynamic_Analysis.yml
Update playbooks to new format.
2026-05-19 11:12:49 -07:00
VirusTotal_v3_Dynamic_Analysis.json
SOARHELP-6700
2026-04-28 10:47:57 -04:00
VirusTotal_v3_Dynamic_Analysis.png
virustotal_v3_dynamic_analysis_playbooks
2023-03-23 12:00:50 +01:00
VirusTotal_v3_Dynamic_Analysis.py
VirusTotal Scoring Algo Fixes
2023-06-07 13:58:16 -05:00
VirusTotal_v3_Dynamic_Analysis.yml
Update playbooks to new format.
2026-05-19 11:12:49 -07:00
VirusTotal_v3_Identifier_Reputation_Analysis.json
SOARHELP-6700
2026-04-28 10:47:57 -04:00
VirusTotal_v3_Identifier_Reputation_Analysis.png
new SOAR content
2023-01-11 11:08:28 -06:00
VirusTotal_v3_Identifier_Reputation_Analysis.py
VirusTotal Scoring Algo Fixes
2023-06-07 13:58:16 -05:00
VirusTotal_v3_Identifier_Reputation_Analysis.yml
Update playbooks to new format.
2026-05-19 11:12:49 -07:00
Windows_Defender_ATP_Identifier_Activity_Analysis.json
SOARHELP-6700
2026-04-28 10:47:57 -04:00
Windows_Defender_ATP_Identifier_Activity_Analysis.png
Initial Commit - Windows Defender ATP Identifier Activity Analysis
2023-03-30 18:12:05 -05:00
Windows_Defender_ATP_Identifier_Activity_Analysis.py
Addressed Kelby's Findings
2023-05-04 14:17:57 -05:00
Windows_Defender_ATP_Identifier_Activity_Analysis.yml
Update playbooks to new format.
2026-05-19 11:12:49 -07:00
Zscaler_Outbound_Traffic_Filtering.json
SOARHELP-6700
2026-04-28 10:47:57 -04:00
Zscaler_Outbound_Traffic_Filtering.png
New ZScaler Playbook
2023-03-31 09:05:32 +02:00
Zscaler_Outbound_Traffic_Filtering.py
Improved the data paths
2023-06-21 11:33:05 +02:00
Zscaler_Outbound_Traffic_Filtering.yml
Update playbooks to new format.
2026-05-19 11:12:49 -07:00