PhishLabs - Whitelist false positives
This playbook can be used in a job to add to the allow list indicators from PhishLabs that were classified as false positives, according to a defined period of time.
- Pack
- PhishLabs
- Tasks
- 5
Inputs
- Since — Whitelist indicators within this duration (from now).
Commands used
- closeInvestigation