Access Investigation - QRadar

Deprecated. No available replacement. This playbook uses the QRadar integration to investigate an access incident by gathering user and IP information. The playbook then interacts with the user that triggered the incident to confirm whether or not they initiated the access action.

Pack
QRadar
Tasks
11

Commands used