ChronicleAsset Investigation - Chronicle
This playbook receives indicators from its parent playbook, performs enrichment and investigation for each one of them, provides an opportunity to isolate and block the hostname or IP address associated with the current indicator, and gives out a list of isolated and blocked entities. This playbook also lists the events fetched for the asset identifier information associated with the indicator.
- Pack
- GoogleChronicleBackstory
- Tasks
- 13
Inputs
- chronicleasset_value — The value of the ChronicleAsset indicator.
- chronicleasset_support_contact — The support email address for the Chronicle asset.
- auto_block_entities — Autoblock the detected suspicious IP address(es). You can manually set this as 'Yes' or 'No' here or you can set it in a 'Chronicle Auto Block Entities' custom incident field.
- skip_entity_isolation — Skip the isolation of entities. You can manually set this as 'Yes' or 'No' here or you can set it in a 'Chronicle Skip Entity Isolation' custom incident field.
Outputs
- IsolatedEntities — List of the isolated entities.
- PotentiallyBlockedIPs — List of potentially blocked IP Addresses.
Commands used
- setIndicator