DSPM Multi-Cloud Risk Remediation

The playbook ensures efficient incident resolution and compliance with security policies by guiding the user through decision points based on incident type, such as empty storage assets or assets open to the world. It concludes by updating the incident status and closing the playbook upon resolution.

Pack

DSPM

Tasks

38

Inputs

• defaultSlackUserName — In the event that the risk asset tag is absent, the risk notice will be sent to this Slack user email address.
• slackMessageLifetime — Lifetime for slack notification (in seconds)
• rerunTime — Incident re-run time (in hours)

Commands used

• addToList
• closeInvestigation
• core-api-post
• createList
• getList
• setList