Incident Response - Infoblox Cloud

This playbook is used to initiate the incident response. This playbook runs when an incident is selected for investigation. It will change the state from pending to active and it will list the available indicators, events, assets, and comments from Infoblox corresponding to the incident. If incident severity is found to be higher than or equivalent to medium, it will create a ServiceNow incident otherwise the given incident will be assigned to an analyst.

Pack

InfobloxBloxOne

Tasks

18

Inputs

• soc_insight_id — Collect incident severity from incident.
• incident_severity — Collect incident severity from incident.
• limit — No of indicators, events, assets or comments to fetch of the provided SOC Insight.
• onCall — Set to true to assign only the user that is currently on shift. Default is False.

Commands used

• infobloxcloud-soc-insight-asset-list
• infobloxcloud-soc-insight-comment-list
• infobloxcloud-soc-insight-event-list
• infobloxcloud-soc-insight-indicator-list
• servicenow-update-ticket