splunk-security_content/docs/_playbooks/email_notification_for_malware.md

title, last_modified_at, toc, toc_label, tags

title	last_modified_at	toc	toc_label	tags
Email Notification for Malware	2021-01-19	true		Response Splunk SOAR VirusTotal WildFire CarbonBlack Response SMTP

Try in Splunk SOAR{: .btn .btn--success}

Description

This playbook tries to determine if a file is malware and whether or not the file is present on any managed machines. VirusTotal "file reputation" and PAN WildFire "detonate file" are used to determine if a file is malware, and CarbonBlack Response "hunt file" is used to search managed machines for the file. The results of these investigations are summarized in an email to the incident response team.

• Type: Response
• Product: Splunk SOAR
• Apps: VirusTotal, WildFire, [CarbonBlack Response](https://splunkbase.splunk.com/apps/#/search/CarbonBlack Response/product/soar), SMTP
• Last Updated: 2021-01-19
• Author: Philip Royer, Splunk
• ID: fb3edc76-ff2b-48b0-5f6f-63da6483fd63

Associated Detections

How To Implement

Be sure to update asset naming to reflect the asset names configured in your environment.

Playbooks

Required field

Reference

source | version: 1