splunk-security_content/docs/_playbooks/risk_notable_block_indicators.md

title, last_modified_at, toc, toc_label, tags

title	last_modified_at	toc	toc_label	tags
Risk Notable Block Indicators	2021-10-22	true		Response Splunk SOAR None Risk Notable

Try in Splunk SOAR{: .btn .btn--success}

Description

This playbook handles locating indicators marked for blocking and determining if any blocking playbooks exist. If there is a match to the appropriate tags in the playbook, a filter block routes the name of the playbook to launch to a code block.

• Type: Response
• Product: Splunk SOAR
• Apps: None
• Last Updated: 2021-10-22
• Author: Kelby Shelton, Splunk
• ID: rn0edc96-ff2b-48b0-9f6f-83da3783fd63

Associated Detections

How To Implement

tbd

Playbooks

Required field

Reference

• https://docs.splunk.com/Documentation/ESSOC/latest/user/Useplaybookpack#Call_child_playbooks_with_the_dynamic_playbook_system
• https://docs.splunk.com/Documentation/ESSOC/latest/user/Useplaybookpack#Indicator_tagging_system

source | version: 1