DTM Alert Incident Response - Google Threat Intelligence

This playbook initiates the response for DTM Alerts in XSOAR when an incident is investigated. For medium or higher severity, it creates a ServiceNow ticket using the "ServiceNow v2" integration; otherwise, the incident is assigned to an analyst. The ticket is enriched with GTI DTM Alert details, including alert type, status, monitor information, summary, AI Doc summary, and tags.

GoogleThreatIntelligence · 19 tasks · 4 inputs · 0 outputs

Inputs

  • alert_id — Collection DTM Alert ID from incident.
  • incident_severity — Collect incident severity from incident.
  • onCall — Set to true to assign only the user that is currently on shift. Default is False.
  • severity_mapping — Set the alert severity mapping as per GTI platform.

Commands used

servicenow-update-ticket

Flowchart

yes No yes yes Start Start Is Google Threat Intelligence - DTM Alerts integration enabled? Is Google Threat Intellig... Extract incident severity and trigger ticket creation task Extract incident severity... Check for incident severity Check for incident severity Assign an analyst to the incident - AssignAnalystToIncident Assign an analyst to the ... AssignAnalystToIncident Is ServiceNow v2 integration enabled? Is ServiceNow v2 integrat... Done Done Create ServiceNow Ticket - Create ServiceNow Ticket Create ServiceNow Ticket Create ServiceNow Ticket Extract DTM Alert status for Ticket Description - SetAndHandleEmpty Extract DTM Alert status ... SetAndHandleEmpty Extract DTM Alert Type for ticket description - SetAndHandleEmpty Extract DTM Alert Type fo... SetAndHandleEmpty Extract DTM Alert Monitor ID for ticket description - SetAndHandleEmpty Extract DTM Alert Monitor... SetAndHandleEmpty Extract DTM Alert Monitor name for ticket description - SetAndHandleEmpty Extract DTM Alert Monitor... SetAndHandleEmpty Extract DTM Alert Summary for ticket description - SetAndHandleEmpty Extract DTM Alert Summary... SetAndHandleEmpty Extract DTM Alert AI Doc Summary for ticket description - SetAndHandleEmpty Extract DTM Alert AI Doc ... SetAndHandleEmpty Extract DTM Alert link for ticket description - SetAndHandleEmpty Extract DTM Alert link fo... SetAndHandleEmpty Extract DTM Alert Tags for ticket description - SetAndHandleEmpty Extract DTM Alert Tags fo... SetAndHandleEmpty Update description of ServiceNow ticket - servicenow-update-ticket Update description of Ser... servicenow-update-ticket War Room Entry for created ServiceNow Ticket - Print War Room Entry for create... Print Clear previous inputs - DeleteContext Clear previous inputs DeleteContext