Code42 Security Alert

Retrieves Incydr alert details, assigns the alert to an analyst, and gathers employee and supervisor data from Active Directory, if applicable. Note: this playbook can be used as an alternate default to "Code42 Exfiltration Playbook" when the Code42 Incydr integration is set to "Fetch Incidents".

Code42 · 8 tasks · 0 inputs · 0 outputs

Commands used

closeInvestigation code42-alert-resolve setIncident

Flowchart

Start Start Tag Alert as Incydr - setIncident Tag Alert as Incydr setIncident Assign Analyst - AssignAnalystToIncident Assign Analyst AssignAnalystToIncident Investigate Alert Investigate Alert Resolve Code42 Alert - code42-alert-resolve Resolve Code42 Alert code42-alert-resolve Close XSOAR Incident - closeInvestigation Close XSOAR Incident closeInvestigation Playbook Complete Playbook Complete Get Code42 Employee Information - Get Code42 Employee Information Get Code42 Employee Infor... Get Code42 Employee Information