Case Investigation - Google SecOps

This playbook investigates a Google SecOps case by retrieving the latest case information, related alerts, and their entities, and updating the case stage. It also calculates severity from IOC scores, updates the incident and case priority accordingly, creates entities in the case from the identified IOCs, and posts a summary comment on the case.

Pack

GoogleChronicleBackstory

Tasks

24

Inputs

• case_id — The ID of the case. Note: Use gcb-case-list command to retrieve case ID.
• alert_limit — Number of alerts to retrieve in the response. The maximum allowed size is 1000.
• entity_limit — Number of entities to retrieve in the response. The maximum allowed size is 1000.

Commands used

• findIndicators
• gcb-case-alert-entity-create
• gcb-case-comment-create
• gcb-case-priority-change
• gcb-case-stage-change
• setIncident