Handle False Positive Alerts

This playbook handles false positive alerts. It creates an alert exclusion or alert exception, or adds a file to an allow list based on the alert fields and playbook inputs.

Pack

CommonPlaybooks

Tasks

20

Inputs

• ShouldCloseAutomatically — Whether to automatically close false positive alerts? Specify true/false.
• sourceIP — The host IP address from the alert.
• username — The username from the alert.
• alertName — The alert name.
• FileSHA256 — The file SHA256 from the alert.
• IOC — The IOC to disable from IOC alerts.
• ShouldHandleFPautomatically — Whether to automatically handle false positive alerts? Specify true/false.

Commands used

• closeInvestigation
• core-add-exclusion
• core-allowlist-files
• core-iocs-disable