CyberBlindspot Incident Management V2

This playbook runs the incidents through indicator enrichment, then based on the mirroring settings, it can communicate with the remote server to assist the user in the next course of action (Whether it be closing the incident, initiating the takedown of an online asset or simply waiting for a process on the remote server to end) to take on the incident if any.

CTM360 · 16 tasks · 0 inputs · 0 outputs

Commands used

closeInvestigation ctm360-cbs-incident-details ctm360-cbs-incident-request-takedown

Flowchart

yes yes Close and Takedown Allowed Close Incident No Action Close Incident Initiate Takedown of Asset No Action yes no yes Start Start Get Incident Remote Status - ctm360-cbs-incident-details Get Incident Remote Status ctm360-cbs-incident-details Check if CyberBlindspot Closed The Incident Check if CyberBlindspot C... Close Incident Locally - closeInvestigation Close Incident Locally closeInvestigation Check if User can Take Action(s) Check if User can Take Ac... Initiate Takedown - ctm360-cbs-incident-request-takedown Initiate Takedown ctm360-cbs-incident-request-t... Check Allowed Action(s) Check Allowed Action(s) Prompt User to Close Incident Prompt User to Close Inci... End of Playbook End of Playbook Assign Analyst - AssignAnalystToIncident Assign Analyst AssignAnalystToIncident Prompt User to Close Incident or Request Takedown of Asset Prompt User to Close Inci... Entity Enrichment - Generic v3 - Entity Enrichment - Generic v3 Entity Enrichment - Gener... Entity Enrichment - Generic v3 Check if Incoming Mirroring is Enabled Check if Incoming Mirrori... Early End of Playbook Early End of Playbook Inform User Regarding Incident Status On Remote - Print Inform User Regarding Inc... Print Check if Integration is Available - IsIntegrationAvailable Check if Integration is A... IsIntegrationAvailable