Splunk Generic

This is a generic playbook to be executed for the Splunk Notable Generic incident type. The playbook performs all the common parts of the investigation, including notifying the SOC, enriching the data for indicators and users, calculating the severity, assigning the incident, notifying the SIEM admin for false positives and more.

Pack

SplunkPy

Tasks

24

Inputs

• Enrich — Determines whether to enrich all indicators in the incident. Default is True.
• OnCall — Set to true to assign only the user that is currently on shift. Default is False. Requires Cortex XSOAR v5.5 or later.
• SocEmailAddress — The SOC team's email address.
• SocMailSubject — The subject of the email to send to the SOC.
• SiemAdminEmailAddress — The SIEM admin's email address.
• UseCalculateSeverity — Determines whether to use the Calculate Severity playbook to calculate the incident severity. Default is True. If the playbook isn't used, the severity is determined by the Splunk severity value.
• SiemAdminMailSubject — The subject of the email to send to the SIEM admin.

Commands used

• closeInvestigation
• extractIndicators
• send-mail
• setIncident