mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Lou Stella
24 lines
951 B
YAML
24 lines
951 B
YAML
name: Email Notification for Malware
|
|
id: fb3edc76-ff2b-48b0-5f6f-63da6483fd63
|
|
version: 1
|
|
date: '2021-01-19'
|
|
author: Philip Royer, Splunk
|
|
type: Response
|
|
description: This playbook tries to determine if a file is malware and whether or not the file is present on any managed machines. VirusTotal "file reputation" and PAN WildFire "detonate file" are used to determine if a file is malware, and CarbonBlack Response "hunt file" is used to search managed machines for the file. The results of these investigations are summarized in an email to the incident response team.
|
|
playbook: email_notification_for_malware
|
|
how_to_implement: "Be sure to update asset naming to reflect the asset names configured in your environment."
|
|
references: []
|
|
app_list:
|
|
- "VirusTotal"
|
|
- "WildFire"
|
|
- "CarbonBlack Response"
|
|
- "SMTP"
|
|
tags:
|
|
platform_tags: []
|
|
playbook_type: Automation
|
|
vpe_type: Classic
|
|
playbook_fields:
|
|
- fileHash
|
|
- vaultId
|
|
product:
|
|
- Splunk SOAR |