mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Lou Stella
27 lines
927 B
YAML
27 lines
927 B
YAML
name: Risk Notable Block Indicators
|
|
id: rn0edc96-ff2b-48b0-9f6f-83da3783fd63
|
|
version: 1
|
|
date: "2021-10-22"
|
|
author: Kelby Shelton, Splunk
|
|
type: Response
|
|
description: This playbook handles locating indicators marked for blocking and determining if any blocking playbooks exist. If there is a match to the appropriate tags in the playbook, a filter block routes the name of the playbook to launch to a code block.
|
|
playbook: risk_notable_block_indicators
|
|
how_to_implement: tbd
|
|
references:
|
|
- https://docs.splunk.com/Documentation/ESSOC/latest/user/Useplaybookpack#Call_child_playbooks_with_the_dynamic_playbook_system
|
|
- https://docs.splunk.com/Documentation/ESSOC/latest/user/Useplaybookpack#Indicator_tagging_system
|
|
app_list:
|
|
- "None"
|
|
tags:
|
|
labels:
|
|
- risk_notable
|
|
playbook_outputs:
|
|
- note_title
|
|
- note_content
|
|
playbook_type: Automation
|
|
vpe_type: Modern
|
|
platform_tags:
|
|
- Risk Notable
|
|
product:
|
|
- Splunk SOAR
|