ASM Issue Incident Response - Google Threat Intelligence

This playbook initiates the response for ASM Issues in XSOAR when an incident is investigated. For medium, high, or critical severity, it creates a ServiceNow ticket using the "ServiceNow v2" integration; otherwise, the incident is assigned to an analyst. The ticket is enriched with GTI ASM Issue details, including entity name, status, confidence, tags, UUID, collection info, and other relevant incident information.

GoogleThreatIntelligence · 21 tasks · 4 inputs · 0 outputs

Inputs

  • issue_uid — Collection ASM issue UID from incident.
  • incident_severity — Collect incident severity from incident.
  • onCall — Set to true to assign only the user that is currently on shift. Default is False.
  • severity_mapping — Set the ASM Issue severity as per GTI platform.

Commands used

servicenow-update-ticket

Flowchart

yes No yes yes Start Start Is Google Threat Intelligence - ASM Issue integration enabled? Is Google Threat Intellig... Extract incident severity and trigger ticket creation task Extract incident severity... Check for incident severity Check for incident severity Assign an analyst to the incident - AssignAnalystToIncident Assign an analyst to the ... AssignAnalystToIncident Is ServiceNow v2 integration enabled? Is ServiceNow v2 integrat... Done Done Create ServiceNow Ticket - Create ServiceNow Ticket Create ServiceNow Ticket Create ServiceNow Ticket Extract ASM Issue UUID for Ticket Description - SetAndHandleEmpty Extract ASM Issue UUID fo... SetAndHandleEmpty Extract ASM Issue confidence for ticket description - SetAndHandleEmpty Extract ASM Issue confide... SetAndHandleEmpty Extract ASM Issue description for ticket description - SetAndHandleEmpty Extract ASM Issue descrip... SetAndHandleEmpty Extract ASM Issue entity name for ticket description - SetAndHandleEmpty Extract ASM Issue entity ... SetAndHandleEmpty Extract ASM issue entity ID for ticket description - SetAndHandleEmpty Extract ASM issue entity ... SetAndHandleEmpty Extract ASM Issue status for ticket description - SetAndHandleEmpty Extract ASM Issue status ... SetAndHandleEmpty Extract ASM Issue link for ticket description - SetAndHandleEmpty Extract ASM Issue link f... SetAndHandleEmpty Extract ASM Issue Tags for ticket description - SetAndHandleEmpty Extract ASM Issue Tags fo... SetAndHandleEmpty Update description of ServiceNow ticket - servicenow-update-ticket Update description of Ser... servicenow-update-ticket Extract ASM Issue Collection name for Ticket Description - SetAndHandleEmpty Extract ASM Issue Collect... SetAndHandleEmpty Extract ASM Issue Collection UUID for Ticket Description - SetAndHandleEmpty Extract ASM Issue Collect... SetAndHandleEmpty War Room Entry for created ServiceNow Ticket - Print War Room Entry for create... Print Clear previous inputs - DeleteContext Clear previous inputs DeleteContext