CyberBlindspot Incident Management V3

This playbook runs the incidents through indicator enrichment, then based on the mirroring settings, it can communicate with the remote server to assist the user in the next course of action (Whether it be closing the incident, initiating the takedown of an online asset or simply waiting for a process on the remote server to end) to take on the incident if any.

CTM360 · 19 tasks · 0 inputs · 0 outputs

Commands used

closeInvestigation ctm360-cbs-incident-details ctm360-cbs-incident-request-takedown

Flowchart

yes yes Close and Takedown Allowed Close Incident No Action Close Incident Initiate Takedown of Asset No Action yes yes yes Start Start Get Incident Remote Status - ctm360-cbs-incident-details Get Incident Remote Status ctm360-cbs-incident-details Is The Remote Incident Closed? Is The Remote Incident Cl... Close Incident Locally - closeInvestigation Close Incident Locally closeInvestigation Is The Incident Pending User Action? Is The Incident Pending U... Initiate Takedown - ctm360-cbs-incident-request-takedown Initiate Takedown ctm360-cbs-incident-request-t... Is There Action To Take? Is There Action To Take? Prompt User to Close Incident Prompt User to Close Inci... End of Playbook End of Playbook Assign Analyst - AssignAnalystToIncident Assign Analyst AssignAnalystToIncident Prompt User to Close Incident or Request Takedown of Asset Prompt User to Close Inci... Entity Enrichment - Generic v3 - Entity Enrichment - Generic v3 Entity Enrichment - Gener... Entity Enrichment - Generic v3 Is Incoming Mirroring Enabled? Is Incoming Mirroring Ena... Early End of Playbook Early End of Playbook Inform User Regarding Incident Status On Remote - Print Inform User Regarding Inc... Print Is CTM360 CyberBlindspot Integration Available? - IsIntegrationAvailable Is CTM360 CyberBlindspot ... IsIntegrationAvailable Get Enabled Instances - GetEnabledInstances Get Enabled Instances GetEnabledInstances Is Source Instance Enabled? Is Source Instance Enabled? CyberBlindspot Retrieve Incident Screenshots - CyberBlindspot Retrieve Incident Screenshots CyberBlindspot Retrieve I... CyberBlindspot Retrieve Incid...