DTM Alert Incident Response - Google Threat Intelligence

This playbook initiates the response for DTM Alerts in XSOAR when an incident is investigated. For medium or higher severity, it creates a ServiceNow ticket using the "ServiceNow v2" integration; otherwise, the incident is assigned to an analyst. The ticket is enriched with GTI DTM Alert details, including alert type, status, monitor information, summary, AI Doc summary, and tags.

Pack

GoogleThreatIntelligence

Tasks

19

Inputs

• alert_id — Collection DTM Alert ID from incident.
• incident_severity — Collect incident severity from incident.
• onCall — Set to true to assign only the user that is currently on shift. Default is False.
• severity_mapping — Set the alert severity mapping as per GTI platform.

Commands used

• servicenow-update-ticket