Investigate On Bad Domain Matches - Chronicle
Use this playbook to investigate and remediate Bad IOC domain matches with recent activity found in the enterprise, as well as notify the SOC lead and network team about the matches. Supported Integrations: - Chronicle - Google SecOps - Whois - Mail Sender (New) - Palo Alto Networks PAN-OS - Palo Alto Networks AutoFocus v2
- Pack
- GoogleChronicleBackstory
- Tasks
- 30
Inputs
- networkteam_email — Enter the email address of the network team that needs to be notified.
- stakeholder_email — Enter the email of the stakeholder to whom you want to send the investigation summary report.
Commands used
- domain
- gcb-assets
- gcb-ioc-details
- pan-os-register-user-tag
- send-mail
- whois