ASM Issue Incident Response - Google Threat Intelligence

This playbook initiates the response for ASM Issues in XSOAR when an incident is investigated. For medium, high, or critical severity, it creates a ServiceNow ticket using the "ServiceNow v2" integration; otherwise, the incident is assigned to an analyst. The ticket is enriched with GTI ASM Issue details, including entity name, status, confidence, tags, UUID, collection info, and other relevant incident information.

Pack

GoogleThreatIntelligence

Tasks

21

Inputs

• issue_uid — Collection ASM issue UID from incident.
• incident_severity — Collect incident severity from incident.
• onCall — Set to true to assign only the user that is currently on shift. Default is False.
• severity_mapping — Set the ASM Issue severity as per GTI platform.

Commands used

• servicenow-update-ticket