splunk-security_content/response_templates/DataBreach_v3.json

{"id": "e2e19dc1-b120-49b4-8b3d-c963e2d7a083", "create_time": 1774287865.5492609, "update_time": 1774289160.9139812, "name": "Data Breach", "description": "", "template_status": "published", "creator": "splunker", "updated_by": "splunker", "is_default": false, "version": 3, "phases": [{"id": "3864ce09-a850-44af-86ef-9ade49d18356", "create_time": 1774287941.2429526, "update_time": 1774289160.8782263, "name": "Escalate to accountable system owners", "order": 1, "tasks": [{"id": "5a3d4ceb-6a30-4aa3-8e8a-b30e3438dff4", "create_time": 1764758755.724739, "update_time": 1774289160.8772032, "name": "Identify accountable system owners", "order": 1, "tag": "f45e1890-72d0-4bdf-8932-ea8d78c2c58f", "description": "Query%20configuration%20management%20databases,%20ask%20teammates,%20and%20query%20on-call%20personnel%20directories%20to%20find%20the%20right%20people%20for%20notification%20and%20response.%0A%0ASuggested%20Dashboards%0A1.%20%20%5BAsset%20Center%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/asset_center)%0A2.%20%20%5BServiceNow%5D(https://splunkbase.splunk.com/app/5932)", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0}, {"id": "8d090f83-6590-48b7-8233-db738d054005", "create_time": 1764758755.7248507, "update_time": 1774289160.8773715, "name": "Notify accountable system owners", "order": 2, "tag": "b0816205-58e4-4e29-991b-f415717d1c03", "description": "Determine%20what%20is%20needed%20from%20each%20team%20member%20and%20notify%20them%20as%20soon%20as%20possible.%20Consider%20speed,%20confidentiality,%20integrity,%20and%20availability%20when%20choosing%20a%20communication%20channel.%20The%20right%20choice%20may%20be%20an%20in-person%20meeting,%20email,%20chat,%20text,%20phone%20call,%20or%20a%20notification%20in%20Splunk%20Mission%20Control.%0A%0ASuggested%20Integration%20(%20if%20not%20already%20configured%20navigate%20%5BHERE%5D(/app/SplunkEnterpriseSecuritySuite/ess_configuration/#/soar/soar_apps/apps)%20to%20locate%20and%20configure)%0A1.%20SMTP%0A2.%20%20MS%20Graph%20for%20Office%20365%0A3.%20%20G%20Suite%20for%20GMail%0A4.%20Cisco%20Webex%0A5.%20Slack%0A6.%20Microsoft%20Teams", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [{"id": "fb4f1d26-5c3c-4c75-92a4-40255f69dd97", "create_time": 1774288031.1043844, "update_time": 1774289160.877492, "last_job_id": 0, "name": "send email - SMTP", "action": "9244", "description": "Sends an email", "type": "send email", "app_id": 260, "asset": 36, "parameters": [{"cc": "", "to": "", "bcc": "", "body": "", "from": "", "headers": "", "subject": "", "attachments": ""}]}, {"id": "8295d8df-66c6-47c0-9a25-ae385051c61c", "create_time": 1774288031.1044605, "update_time": 1774289160.8775496, "last_job_id": 0, "name": "send email - MS Graph for Office 365", "action": "8880", "description": "Sends an email with optional text rendering. Attachments are allowed a Content-ID tag for reference within the html", "type": "send email", "app_id": 175, "asset": 15, "parameters": [{"cc": "", "to": "", "bcc": "", "body": "", "from": "", "headers": "", "subject": "", "attachments": ""}]}, {"id": "609ce7bd-2b56-4df4-a991-339d9ee0b7c9", "create_time": 1774288031.1045365, "update_time": 1774289160.8776064, "last_job_id": 0, "name": "send email - G Suite for GMail", "action": "9227", "description": "Send emails", "type": "send email", "app_id": 123, "asset": 34, "parameters": [{"cc": "", "to": "", "bcc": "", "body": "", "from": "", "headers": "", "subject": "", "reply_to": "", "alias_name": "", "alias_email": "", "attachments": ""}]}, {"id": "e9a395b1-c800-4b18-b048-29c93848299e", "create_time": 1774288031.1046116, "update_time": 1774289160.8776598, "last_job_id": 0, "name": "send message - Cisco Webex", "action": "9205", "description": "Send message to user or room", "type": "send message", "app_id": 64, "asset": 32, "parameters": [{"message": "", "endpoint_id": "", "is_markdown": false, "destination_type": ""}]}, {"id": "fae69304-4e1e-4c82-8325-db1805305540", "create_time": 1774288031.1046865, "update_time": 1774289160.8777187, "last_job_id": 0, "name": "send chat message - Microsoft Teams", "action": "9235", "description": "Send a message to specific chat", "type": "send chat message", "app_id": 198, "asset": 35, "parameters": [{"chat_id": "", "message": ""}]}, {"id": "09fc8afc-f135-48c3-b3d9-ea2f8fa51388", "create_time": 1774288031.1047611, "update_time": 1774289160.8777926, "last_job_id": 0, "name": "send message - Slack", "action": "8927", "description": "Send a message to Slack", "type": "send message", "app_id": 277, "asset": 22, "parameters": [{"blocks": "", "message": "", "link_names": false, "destination": "", "reply_broadcast": false, "parent_message_ts": ""}]}], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0}, {"id": "2950919f-a5ca-4dec-b3d0-5ef7edf213e3", "create_time": 1764758755.7249453, "update_time": 1774289160.8779156, "name": "Set up collaboration channels", "order": 3, "tag": "2b1518b8-77a6-4e03-8b50-e0a89dc40ed8", "description": "Establish%20shared%20access%20to%20the%20appropriate%20notable%20investigation%20that%20is%20tracking%20the%20data%20breach.%20If%20necessary%20establish%20an%20additional%20channel%20for%20communications%20such%20as%20a%20chat%20room,%20email%20chain,%20ticketing%20system,%20or%20VictorOps%20Incident.%0A%0ASuggested%20Integration%20(%20if%20not%20already%20configured%20navigate%20%5BHERE%5D(/app/SplunkEnterpriseSecuritySuite/ess_configuration/#/soar/soar_apps/apps)%20to%20locate%20and%20configure)%0A1.%20Cisco%20Webex%0A2.%20Slack%0A3.%20Microsoft%20Teams", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [{"id": "3b80c74f-a322-4f6d-8d2c-82c9c8d27b59", "create_time": 1774288120.2887971, "update_time": 1774289160.8780336, "last_job_id": 0, "name": "create a room - Cisco Webex", "action": "9206", "description": "Create a new Webex room (space)", "type": "create a room", "app_id": 64, "asset": 32, "parameters": [{"title": "", "team_id": "", "is_locked": false, "is_public": false, "description": "", "classification_id": "", "is_announcement_only": false}]}, {"id": "4bf098b7-b12e-472d-a3fa-02245d87e7c9", "create_time": 1774288120.2888381, "update_time": 1774289160.8780959, "last_job_id": 0, "name": "create channel - Slack", "action": "8922", "description": "Create a new Slack channel", "type": "create channel", "app_id": 277, "asset": 22, "parameters": [{"name": "", "channel_type": ""}]}, {"id": "172d000e-e2cb-45b1-a992-1ba15eca0a0d", "create_time": 1774288120.2888784, "update_time": 1774289160.8781688, "last_job_id": 0, "name": "create meeting - Microsoft Teams", "action": "9239", "description": "Create a microsoft teams meeting", "type": "create meeting", "app_id": 198, "asset": 35, "parameters": [{"subject": "", "end_time": "", "attendees": "", "start_time": "", "description": "", "add_calendar_event": false}]}], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0}]}, {"id": "fa5bb456-dfe8-4f27-88a3-1639a35796c6", "create_time": 1774287941.2432802, "update_time": 1774289160.879311, "name": "Stop exfiltration", "order": 2, "tasks": [{"id": "3fcbd598-8be3-4c81-a89e-1896912ffea4", "create_time": 1764758755.725092, "update_time": 1774289160.8783479, "name": "Identify likely means of exfiltration", "order": 1, "tag": "b562799f-7155-43a2-a36a-e736575a6b1d", "description": "Evaluate%20likely%20means%20of%20exfiltration%20using%20the%20information%20from%20the%20initial%20detection%20and%20any%20other%20associated%20investigation%20the%20team%20can%20conduct.%20Use%20https://attack.mitre.org/wiki/Persistence%20and%20other%20open%20source%20intelligence%20to%20check%20for%20common%20exfiltration%20mechanisms.%20Consider%20the%20sophistication%20of%20the%20adversary,%20the%20data%20that%20is%20likely%20to%20be%20targeted,%20the%20systems%20that%20may%20have%20been%20breached,%20and%20any%20other%20knowledge%20from%20further%20investigation.%20Query%20the%20logs%20of%20any%20available%20systems%20around%20the%20time%20of%20the%20incident%20for%20context%20and%20additional%20leads.%20If%20possible%20analyze%20and/or%20reverse%20engineer%20any%20executables%20or%20scripts%20discovered%20in%20the%20investigation.%20Try%20to%20determine%20exfiltration%20mechanisms,%20protocols,%20ports,%20IP%20addresses,%20hostnames,%20URLs,%20and%20other%20indicators.%0A%0ASuggested%20Dashboards%0A1.%20%5BRisk%20Analysis%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/risk_analysis)%0A2.%20%5BTraffic%20Center%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/traffic_center)%0A3.%20%5BPort%20and%20Protocol%20Tracker%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/port_protocol_tracker)", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0}, {"id": "b7bfe3f3-8035-45bd-a16a-4d847cb74ba3", "create_time": 1764758755.725215, "update_time": 1774289160.8785653, "name": "Determine mitigations and remediations", "order": 2, "tag": "2c398364-ef0f-4e7d-877e-0abfaa91d72d", "description": "Taking into account the confidentiality and availability considerations of the systems involved, determine which mitigations and remediations are appropriate.", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0}, {"id": "0a27527c-f0c1-4e54-a875-d110a8f71cb8", "create_time": 1764758755.7253134, "update_time": 1774289160.8787036, "name": "Stop exfiltration", "order": 3, "tag": "e80c691b-9bab-4f4d-86ca-8496300842c3", "description": "Use%20host-based%20or%20network%20controls%20to%20interrupt%20exfiltration.%20Scope%20the%20response%20according%20to%20the%20severity%20of%20the%20event.%0A%0ASuggested%20Integration%20(%20if%20not%20already%20configured%20navigate%20%5BHERE%5D(/app/SplunkEnterpriseSecuritySuite/ess_configuration/#/soar/soar_apps/apps)%20to%20locate%20and%20configure)%0A1.%20Cisco%20Firepower%0A2.%20Cisco%20Secure%20Firewall%0A3.%20Palo%20Alto%0A4.%20Zscaler%0A5.%20Crowdstrike%0A6.%20Microsoft%20Defender%20for%20Endpoint%0A8.%20VMware%20Carbon%20Black%20Cloud%20for%20Splunk%20SOAR", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [{"id": "119ecead-be36-4973-9acc-b969a3564869", "create_time": 1774288573.2906215, "update_time": 1774289160.878848, "last_job_id": 0, "name": "block ip - Cisco Firepower", "action": "9266", "description": "Blocks an IP network", "type": "block ip", "app_id": 56, "asset": 40, "parameters": [{"ip": ""}]}, {"id": "3e1e7dd1-ebc7-420f-bed4-b8dffdc068fb", "create_time": 1774288573.2906923, "update_time": 1774289160.8789067, "last_job_id": 0, "name": "delete quarantine message - Cisco Secure Email and Web Manager", "action": "9301", "description": "Delete a message from Policy, Virus, Outbreak, or other quarantines", "type": "delete quarantine message", "app_id": 58, "asset": 46, "parameters": [{"message_id": "", "quarantine_name": ""}]}, {"id": "825d5aaa-09bf-4fb2-9cb4-b003c15ae449", "create_time": 1774288573.2907615, "update_time": 1774289160.8789642, "last_job_id": 0, "name": "delete network object - Cisco Secure Firewall", "action": "9272", "description": "Deletes a network object in FMC", "type": "delete network object", "app_id": 59, "asset": 41, "parameters": [{"type": "", "object_id": "", "domain_name": ""}]}, {"id": "8218c3fe-f630-495e-8770-5adf21953aa7", "create_time": 1774288573.290845, "update_time": 1774289160.8790226, "last_job_id": 0, "name": "block ip - Panorama", "action": "8651", "description": "Block an IP", "type": "block ip", "app_id": 220, "asset": 42, "parameters": [{"ip": "", "policy_name": "", "policy_type": "", "device_group": "", "audit_comment": "", "should_add_tag": false, "is_source_address": false, "use_partial_commit": false, "should_commit_changes": false}]}, {"id": "f3368aca-7d5f-4b08-950d-ceec8a1c0c3a", "create_time": 1774288573.2909112, "update_time": 1774289160.8790784, "last_job_id": 0, "name": "block url - Panorama", "action": "8647", "description": "Block an URL", "type": "block url", "app_id": 220, "asset": 42, "parameters": [{"url": "", "policy_name": "", "policy_type": "", "device_group": "", "audit_comment": "", "use_partial_commit": false, "should_commit_changes": false}]}, {"id": "d05fb5f5-6242-4b51-801c-9458b07af0be", "create_time": 1774288573.2909768, "update_time": 1774289160.879136, "last_job_id": 0, "name": "block url - Zscaler", "action": "9075", "description": "Block a URL", "type": "block url", "app_id": 338, "asset": 30, "parameters": [{"url": "", "url_category": ""}]}, {"id": "f11ce869-5b0d-4439-9405-b5b46d91615b", "create_time": 1774288573.2910228, "update_time": 1774289160.8791957, "last_job_id": 0, "name": "block hash - Carbon Black Response", "action": "8753", "description": "Add a hash to the Carbon Black Response blacklist", "type": "block hash", "app_id": 48, "asset": 10, "parameters": [{"hash": "", "comment": ""}]}, {"id": "4f8c2c9d-f120-4da7-836f-e5cbf5496bcb", "create_time": 1774288573.291066, "update_time": 1774289160.8792562, "last_job_id": 0, "name": "remove hosts - CrowdStrike OAuth API", "action": "8764", "description": "Remove one or more hosts from the static host group", "type": "remove hosts", "app_id": 77, "asset": 44, "parameters": [{"hostname": "", "device_id": "", "host_group_id": ""}]}], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0}]}, {"id": "a1d5e293-2b61-43f1-a776-f8d2126a1d7a", "create_time": 1774287941.2435129, "update_time": 1774289160.8805084, "name": "Remove persistent adversaries", "order": 3, "tasks": [{"id": "fecaae1e-a6d8-47b2-8386-5af5bcac6d54", "create_time": 1764758755.7254562, "update_time": 1774289160.8794274, "name": "Identify likely means of persistence", "order": 1, "tag": "27ff7f99-5263-4a23-ba71-775e2a96ea00", "description": "Trace%20exfiltration%20as%20far%20as%20possible%20back%20toward%20a%20root%20cause.%20Look%20for%20patterns%20of%20activity%20from%20scheduled%20tasks,%20system%20restarts,%20polling%20of%20external%20systems,%20and%20other%20common%20means%20of%20persistence.%20Sysinternals%20AutoRuns%20and%20other%20similar%20tools%20can%20check%20wide%20varieties%20of%20persistence%20mechanisms.%0A%0ASuggested%20Dashboards%0A1.%20%5BTraffic%20Center%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/traffic_center)%0A2.%20%5BEndpoint%20Changes%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/endpoint_changes)%0A3.%20%5BMalware%20Center%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/malware_center)%0A4.%20%5BMalware%20Search%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/malware_search)%0A5.%20%5BEmail%20Search%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/email_search)%0A6.%20%5BRisk%20Analysis%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/risk_analysis)", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0}, {"id": "a951c1a1-61c6-4afa-b0c7-c721a97b5d3e", "create_time": 1764758755.7255518, "update_time": 1774289160.8795922, "name": "Remove identified persistence mechanisms", "order": 2, "tag": "3c87ad49-a462-47b1-93fa-401c82da9270", "description": "Block%20adversary%20persistence%20at%20the%20host%20and/or%20network%20level.%0A%0ASuggested%20Integration%20(%20if%20not%20already%20configured%20navigate%20%5BHERE%5D(/app/SplunkEnterpriseSecuritySuite/ess_configuration/#/soar/soar_apps/apps)%20to%20locate%20and%20configure)%0A1.%20Cisco%20Firepower%0A2.%20Cisco%20Secure%20Firewall%0A3.%20Palo%20Alto%0A4.%20Zscaler%0A5.%20Crowdstrike%0A6.%20Microsoft%20Defender%20for%20Endpoint%0A8.%20VMware%20Carbon%20Black%20Cloud%20for%20Splunk%20SOAR", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [{"id": "d6ba4fb5-57f0-4fdc-993d-8f16b0b42a99", "create_time": 1774289010.1603703, "update_time": 1774289160.8796725, "last_job_id": 0, "name": "block hash - Carbon Black Response", "action": "8753", "description": "Add a hash to the Carbon Black Response blacklist", "type": "block hash", "app_id": 48, "asset": 10, "parameters": [{"hash": "", "comment": ""}]}, {"id": "cf4044d4-6466-4169-beed-1e036f2b7e23", "create_time": 1774289010.1604114, "update_time": 1774289160.8797085, "last_job_id": 0, "name": "quarantine device - Carbon Black Response", "action": "8740", "description": "Quarantine the endpoint", "type": "quarantine device", "app_id": 48, "asset": 10, "parameters": [{"ip_hostname": ""}]}, {"id": "60c17f92-392c-481b-8374-0080eb9a0313", "create_time": 1774289010.160452, "update_time": 1774289160.8797436, "last_job_id": 0, "name": "terminate process - Carbon Black Response", "action": "8745", "description": "Kill running processes on a machine", "type": "terminate process", "app_id": 48, "asset": 10, "parameters": [{"pid": "", "sensor_id": "", "ip_hostname": ""}]}, {"id": "5b3dcec1-5451-4d3a-b577-d1d9db5ddf5d", "create_time": 1774289010.160493, "update_time": 1774289160.879811, "last_job_id": 0, "name": "quarantine device - Windows Defender ATP", "action": "9016", "description": "Quarantine the device", "type": "quarantine device", "app_id": 191, "asset": 45, "parameters": [{"type": "", "comment": "", "timeout": "", "device_id": ""}]}, {"id": "a237f984-d561-4784-9c82-e44b3986ec28", "create_time": 1774289010.1605334, "update_time": 1774289160.8798656, "last_job_id": 0, "name": "restrict app execution - Windows Defender ATP", "action": "9033", "description": "Restrict execution of all applications on the device except a predefined set", "type": "restrict app execution", "app_id": 191, "asset": 45, "parameters": [{"comment": "", "timeout": "", "device_id": ""}]}, {"id": "983f3496-bd56-424e-afbc-bc869e5c955f", "create_time": 1774289010.1605744, "update_time": 1774289160.8799238, "last_job_id": 0, "name": "delete indicator - Windows Defender ATP", "action": "9036", "description": "Delete an Indicator entity by ID", "type": "delete indicator", "app_id": 191, "asset": 45, "parameters": [{"indicator_id": ""}]}, {"id": "65ca4463-c184-4aff-82d3-5f2bf13c4768", "create_time": 1774289010.1606147, "update_time": 1774289160.8799837, "last_job_id": 0, "name": "delete indicator - CrowdStrike OAuth API", "action": "8800", "description": "Delete an indicator that is being watched", "type": "delete indicator", "app_id": 77, "asset": 44, "parameters": [{"ioc": "", "resource_id": ""}]}, {"id": "51073d4f-891e-4dc7-8a7b-0ba42059fa3a", "create_time": 1774289010.1606548, "update_time": 1774289160.8800373, "last_job_id": 0, "name": "delete session - CrowdStrike OAuth API", "action": "8766", "description": "Deletes a Real Time Response session", "type": "delete session", "app_id": 77, "asset": 44, "parameters": [{"session_id": ""}]}, {"id": "389d8dce-e69b-483c-82a6-3501df1c576e", "create_time": 1774289010.1606956, "update_time": 1774289160.8800964, "last_job_id": 0, "name": "quarantine device - CrowdStrike OAuth API", "action": "8761", "description": "Block the device", "type": "quarantine device", "app_id": 77, "asset": 44, "parameters": [{"hostname": "", "device_id": ""}]}, {"id": "b1f59d99-56b7-4653-a5c6-22fdec2979d7", "create_time": 1774289010.1607356, "update_time": 1774289160.8801548, "last_job_id": 0, "name": "remove hosts - CrowdStrike OAuth API", "action": "8764", "description": "Remove one or more hosts from the static host group", "type": "remove hosts", "app_id": 77, "asset": 44, "parameters": [{"hostname": "", "device_id": "", "host_group_id": ""}]}, {"id": "0d104942-fffd-45b2-b947-ecd4ce5af87d", "create_time": 1774289010.1607919, "update_time": 1774289160.8801985, "last_job_id": 0, "name": "block ip - Zscaler", "action": "9074", "description": "Block an IP", "type": "block ip", "app_id": 338, "asset": 30, "parameters": [{"ip": "", "url_category": ""}]}, {"id": "09a177b0-7fa7-4bc0-b601-531f7a465438", "create_time": 1774289010.160834, "update_time": 1774289160.880234, "last_job_id": 0, "name": "block url - Zscaler", "action": "9075", "description": "Block a URL", "type": "block url", "app_id": 338, "asset": 30, "parameters": [{"url": "", "url_category": ""}]}, {"id": "b375ddea-966c-4a69-88be-75beeedbf929", "create_time": 1774289010.1608748, "update_time": 1774289160.8802693, "last_job_id": 0, "name": "unallow ip - Zscaler", "action": "9080", "description": "Remove an IP address from the allowlist", "type": "unallow ip", "app_id": 338, "asset": 30, "parameters": [{"ip": "", "url_category": ""}]}, {"id": "683e66a6-9c42-40e3-80a4-653f0236a788", "create_time": 1774289010.1609147, "update_time": 1774289160.8803039, "last_job_id": 0, "name": "unallow url - Zscaler", "action": "9081", "description": "Remove a URL from the allowed list", "type": "unallow url", "app_id": 338, "asset": 30, "parameters": [{"url": "", "url_category": ""}]}, {"id": "e33ba4d3-5c5e-44da-81de-5973d0c20649", "create_time": 1774289010.1609552, "update_time": 1774289160.8803377, "last_job_id": 0, "name": "block ip - Panorama", "action": "8651", "description": "Block an IP", "type": "block ip", "app_id": 220, "asset": 42, "parameters": [{"ip": "", "policy_name": "", "policy_type": "", "device_group": "", "audit_comment": "", "should_add_tag": false, "is_source_address": false, "use_partial_commit": false, "should_commit_changes": false}]}, {"id": "b8abfae5-06d4-4647-8636-90eb68833bb4", "create_time": 1774289010.1609964, "update_time": 1774289160.8803725, "last_job_id": 0, "name": "block url - Panorama", "action": "8647", "description": "Block an URL", "type": "block url", "app_id": 220, "asset": 42, "parameters": [{"url": "", "policy_name": "", "policy_type": "", "device_group": "", "audit_comment": "", "use_partial_commit": false, "should_commit_changes": false}]}, {"id": "b470de29-5bcf-4924-992b-2212c5571df9", "create_time": 1774289010.1610365, "update_time": 1774289160.880407, "last_job_id": 0, "name": "block application - Panorama", "action": "8649", "description": "Block an application", "type": "block application", "app_id": 220, "asset": 42, "parameters": [{"application": "", "policy_name": "", "policy_type": "", "device_group": "", "audit_comment": "", "use_partial_commit": false, "should_commit_changes": false}]}, {"id": "0d40c5f2-4ceb-412c-8d4d-4be96f91b931", "create_time": 1774289010.1610768, "update_time": 1774289160.8804412, "last_job_id": 0, "name": "delete network object - Cisco Secure Firewall", "action": "9272", "description": "Deletes a network object in FMC", "type": "delete network object", "app_id": 59, "asset": 41, "parameters": [{"type": "", "object_id": "", "domain_name": ""}]}, {"id": "9c31ecc4-7f65-45b4-8b15-2203fc08b2ad", "create_time": 1774289010.1611164, "update_time": 1774289160.8804746, "last_job_id": 0, "name": "block ip - Cisco Firepower", "action": "9266", "description": "Blocks an IP network", "type": "block ip", "app_id": 56, "asset": 40, "parameters": [{"ip": ""}]}], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0}]}, {"id": "9577e82b-f68e-4fa7-a86b-987bbb51a504", "create_time": 1774287941.2436419, "update_time": 1774289160.8806567, "name": "Assess impact", "order": 4, "tasks": [{"id": "be68378a-13d6-499d-bc94-d7f54c51e012", "create_time": 1764758755.7256913, "update_time": 1774289160.8805795, "name": "Measure the size and scope", "order": 1, "tag": "26cca1bb-80c3-43ab-ab5b-13975111b607", "description": "Measure%20the%20impact%20of%20the%20breach%20by%20amount%20of%20data,%20importance%20of%20data,%20potential%20follow-on%20impacts,%20and%20other%20appropriate%20criteria.%0A%0ASuggested%20Dashboards%0A1.%20%5BRisk%20Analysis%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/risk_analysis)%0A2.%20%5BTraffic%20Center%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/traffic_center)%0A3.%20%5BPort%20and%20Protocol%20TrackerDashboard%5D(/app/SplunkEnterpriseSecuritySuite/port_protocol_tracker)%0A4.%20%5BMalware%20Center%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/malware_center)%0A5.%20%5BMalware%20Search%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/malware_search)%0A6.%20%5BEmail%20Search%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/email_search)", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0}]}, {"id": "befcad6f-d66d-459c-8b71-9ac22c902c6f", "create_time": 1774287941.243847, "update_time": 1774289160.8810508, "name": "Report to appropriate stakeholders", "order": 5, "tasks": [{"id": "aa30f51a-a2fb-4284-be1d-c8d6a0f2935b", "create_time": 1764758755.7259164, "update_time": 1774289160.8807235, "name": "Identify appropriate stakeholders", "order": 1, "tag": "4bb2a31a-ccc7-4bc3-a5b7-cf946cb10fb0", "description": "Identify%20who%20should%20receive%20which%20information.%20This%20may%20include%20the%20regulatory%20compliance%20team,%20all%20internal%20employees,%20customers,%20partners,%20appropriate%20government%20officials,%20the%20public,%20system%20vendors,%20open%20source%20communities,%20and%20others.%0A%0A", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0}, {"id": "c2c0365b-7e90-4f34-a074-05b31a6bbb00", "create_time": 1764758755.7260718, "update_time": 1774289160.8808408, "name": "Send reports", "order": 2, "tag": "03fd935b-9848-4eee-8179-1d33592a2658", "description": "Send%20the%20appropriate%20amount%20of%20information%20to%20identified%20parties.%20If%20it%20is%20beneficial,%20give%20them%20a%20way%20to%20respond%20to%20the%20information.%0A%0ASuggested%20Integration%20(%20if%20not%20already%20configured%20navigate%20%5BHERE%5D(/app/SplunkEnterpriseSecuritySuite/ess_configuration/#/soar/soar_apps/apps)%20to%20locate%20and%20configure)%0A1.%20SMTP%0A2.%20%20MS%20Graph%20for%20Office%20365%0A3.%20%20G%20Suite%20for%20GMail", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [{"id": "aebaf640-6009-4f2a-abac-b3c51ded075e", "create_time": 1774289143.4113786, "update_time": 1774289160.8809183, "last_job_id": 0, "name": "send email - SMTP", "action": "9244", "description": "Sends an email", "type": "send email", "app_id": 260, "asset": 36, "parameters": [{"cc": "", "to": "", "bcc": "", "body": "", "from": "", "headers": "", "subject": "", "attachments": ""}]}, {"id": "3f0c6356-464d-45fd-bbf3-15045cc60d30", "create_time": 1774289143.4114497, "update_time": 1774289160.8809786, "last_job_id": 0, "name": "send email - MS Graph for Office 365", "action": "8880", "description": "Sends an email with optional text rendering. Attachments are allowed a Content-ID tag for reference within the html", "type": "send email", "app_id": 175, "asset": 15, "parameters": [{"cc": "", "to": "", "bcc": "", "body": "", "from": "", "headers": "", "subject": "", "attachments": ""}]}, {"id": "8c1c9387-d74c-4fc5-802f-b4ed1f4ee833", "create_time": 1774289143.4115171, "update_time": 1774289160.881021, "last_job_id": 0, "name": "send email - G Suite for GMail", "action": "9227", "description": "Send emails", "type": "send email", "app_id": 123, "asset": 34, "parameters": [{"cc": "", "to": "", "bcc": "", "body": "", "from": "", "headers": "", "subject": "", "reply_to": "", "alias_name": "", "alias_email": "", "attachments": ""}]}], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0}]}, {"id": "370933e2-b9c1-4de8-90bd-10477e48ed7e", "create_time": 1774287941.2439544, "update_time": 1774289160.8811643, "name": "Prevent future breaches", "order": 6, "tasks": [{"id": "574bfcd8-31c3-4b51-9e73-b8a35403894c", "create_time": 1764758755.726329, "update_time": 1774289160.881119, "name": "Prevent future breaches", "order": 1, "tag": "690e3199-c277-4a6f-8ada-9c4c5bbc3e48", "description": "Use information from this case to investigate further, apply patches, prevent behaviors, change systems, and otherwise prevent similar situations from occurring again. Setup automated checks for reinfection using similar indicators or TTP's.", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0}]}], "origin": {"id": "b0ad7421-221a-4859-8af7-7cd8949ad10f", "name": "Data Breach", "version": 3}, "template_id": "e5fe0058-dea9-40bb-999a-1ee820cfd505", "active": true, "used": false, "ai_generated": false, "source_attachment_id": null, "_user": "nobody", "_key": "e2e19dc1-b120-49b4-8b3d-c963e2d7a083"}