SOCRadar Incident

Performs indicator extraction and enrichment from the incident content, calculates the severity level, assigns the incident to a particular analyst, notifies SOCRadar platform for the incident response (to mark it as false positive or resolved) and generates investigation summary report just before closing the investigation in the end. This playbook is executed for the SOCRadar Generic incident type.

Pack

SOCRadar

Tasks

21

Inputs

• AutoEnrich — Auto Enrich input to be used for extracting indicators out of the incident content automatically at the beginning of the playbook. (Options: Yes/No)

Commands used

• closeInvestigation
• extractIndicators
• setIncident
• socradar-mark-incident-fp
• socradar-mark-incident-resolved