Phishing - Indicators Hunting
Hunt indicators related to phishing with available integrations and then handle the results. Handling the results will include setting relevant incident fields which will be displayed in the layout and optionally, opening new incidents according to the findings. Current integration in this playbook: - Microsoft 365 Defender (using "Advanced Hunting") Note that this playbook should be used as a sub-playbook inside a phishing incident and not as a main playbook.
- Pack
- Phishing
- Tasks
- 5
Inputs
- DBotScore — The DBotScore object containing these keys: - Indicator - Type - Score
- EmailHuntingCreateNewIncidents — When "True", the "Phishing - Handle Microsoft 365 Defender Results" sub-playbook will create new phishing incidents for each email that contains one of the malicious indicators. Default is "False".
- ListenerMailbox — The mailbox of the listening integration. In case it is provided, the emails found in it will be ignored.