Illusive - Incident Escalation
This playbook is used for creating an automatic analysis of the Illusive's incident details, in order to end up with a certain score or a set of insights that will enable automatic decisions and actions.
- Pack
- IllusiveNetworks
- Tasks
- 42
Inputs
- proximity_threshold — The maximum number of steps from crown jewel, or domain admin credentials to determine the proximity as high-risk
- events_threshold — The minimum number of associated events to determine this incident as a multiple-events incident
- proximity_weight — The unified score in case the proximity to a crown jewel and/ or the proximity to domain admin credentials is under the specified threshold
- triggering_weight — The unified score in case the triggering process has been found malicious and/ or the triggering deception is ransomware
- events_weight — The score in case the number of events in the inspected incident is above the specified threshold
- rdp_weight — The score in case there is an active RDP connection to the source host
- illusive_incident_id — The incident ID of the Illusive Networks Incident
Outputs
- Illusive.IncidentEscalationPlaybook.incidentId — The corresponding incident ID
- Illusive.IncidentEscalationPlaybook.isCloseToCrownJewel — Whether the proximity to a crown jewel is under a certain threshold
- Illusive.IncidentEscalationPlaybook.isCloseToAdminCredentials — Whether the proximity to domain admin credentials is under a certain threshold
- Illusive.IncidentEscalationPlaybook.isMultipleEvents — Whether the number of associated events is above a certain threshold
- Illusive.IncidentEscalationPlaybook.isTriggeringProcessMalicious — Whether the triggering process has been found malicious by VirusTotal
- Illusive.IncidentEscalationPlaybook.isActiveRdpConnection — Whether there is an active RDP connection to the source host
- Illusive.IncidentEscalationPlaybook.isRansomware — Whether the triggering deception is ransomware
- Illusive.IncidentEscalationPlaybook.incidentScore — The accumulated score of the incident
Commands used
- illusive-get-forensics-analyzers
- illusive-get-incident-events
- illusive-get-incidents
- setIncident