TIM - Indicator Relationships Analysis

This playbook is designed to assist with a security investigation by providing an analysis of indicator relationships. The following information is included: - Indicators of compromise (IOCs) related to the investigation. - Attack patterns related to the investigation. - Campaigns related to the investigation. - IOCs associated with the identified campaigns. - Reports containing details on the identified campaigns.

Pack

TIM_Processing

Tasks

20

Inputs

• Indicator — Input an indicator to analyze its relationships.
• LimitResults — The number of results to return. If the input is empty, the limit will be 20.

Outputs

• RelatedAttackPatterns — Attack patterns related to the indicator.
• RelatedCampaign — Campaign related to the indicator.
• RelatedReport — Report related to the campaign.
• RelatedFiles — Files related to the indicator and campaign.
• RelatedDomains — Domains related to the indicator and campaign.
• RelatedIPs — IPs related to the indicator and campaign.
• RelatedURLs — URLs related to the indicator and campaign.