ChronicleAsset Investigation - Chronicle

This playbook receives indicators from its parent playbook, performs enrichment and investigation for each one of them, provides an opportunity to isolate and block the hostname or IP address associated with the current indicator, and gives out a list of isolated and blocked entities. This playbook also lists the events fetched for the asset identifier information associated with the indicator.

Google SecOps · 13 tasks · 4 inputs · 2 outputs

Inputs

  • chronicleasset_value — The value of the ChronicleAsset indicator.
  • chronicleasset_support_contact — The support email address for the Chronicle asset.
  • auto_block_entities — Autoblock the detected suspicious IP address(es). You can manually set this as 'Yes' or 'No' here or you can set it in a 'Chronicle Auto Block Entities' custom incident field.
  • skip_entity_isolation — Skip the isolation of entities. You can manually set this as 'Yes' or 'No' here or you can set it in a 'Chronicle Skip Entity Isolation' custom incident field.

Outputs

  • IsolatedEntities — List of the isolated entities.
  • PotentiallyBlockedIPs — List of potentially blocked IP Addresses.

Commands used

setIndicator

Flowchart

yes yes yes yes Start Start Done Done Clear previous indicator data from the context - DeleteContext Clear previous indicator ... DeleteContext Clear the list of events associated with the previous indicator from the context - DeleteContext Clear the list of events ... DeleteContext Search ChronicleAsset indicator - SixgillSearchIndicators Search ChronicleAsset ind... SixgillSearchIndicators Is Chronicle Asset Identifier information present? Is Chronicle Asset Identi... List Device Events - Chronicle - List Device Events - Chronicle List Device Events - Chro... List Device Events - Chronicle Is there an event? Is there an event? Save fetched events in ChronicleAsset Events field - setIndicator Save fetched events in Ch... setIndicator Fetch list of events associated with the asset identifiers Fetch list of events asso... Hostname And IP Address Investigation And Remediation - Chronicle - Hostname And IP Address Investigation And Remediation - Chronicle Hostname And IP Address I... Hostname And IP Address Inves... Is there a hostname or an IP address associated with the ChronicleAsset? Is there a hostname or an... Hostname and IP Address Enrichment and Remediation Hostname and IP Address E...