Illusive-Retrieve-Incident

This playbook is used for retrieving an extensive view over a detected incident by retrieving the incident details and a forensics timeline if and when forensics have been successfully collected.

Pack

IllusiveNetworks

Tasks

6

Inputs

• incident_id — The desired incident ID to retrieve.
• start_date — The starting date of the forensics timeline.
• end_date — The last date of the forensics timeline.

Outputs

• Illusive.Forensics.Evidence.details — The forensics evidence details
• Illusive.Forensics.Evidence.eventId — The event ID
• Illusive.Forensics.Evidence.id — The forensics evidence ID
• Illusive.Forensics.Evidence.source — The Evidence source
• Illusive.Forensics.Evidence.starred — Whether the forensics evidence has been starred
• Illusive.Forensics.Evidence.time — Date and time of the forensics evidence
• Illusive.Forensics.Evidence.title — The forensics evidence description
• Illusive.Forensics.IncidentId — The Incident Id

Commands used

• illusive-get-forensics-timeline
• illusive-get-incidents