ExtraHop - Default

Default playbook to run for all ExtraHop Detection incidents. This playbook handles ticket tracking as well as triggering specific playbooks based on the name of the ExtraHop Detection.

ExtraHop Reveal(x) · 9 tasks · 0 inputs · 4 outputs

Outputs

  • CVE — Details on the CVE.
  • ExtraHop.Device — Details on the host and any peer devices found.
  • ExtraHop.ActivityMap — The link to a visual activity map in ExtraHop.
  • ExtraHop.Record.Source — Associated transaction records from ExtraHop.

Flowchart

yes yes BlueKeep Start Start Done Done Is ExtraHop Reveal(x) enabled? - Exists Is ExtraHop Reveal(x) ena... Exists ExtraHop - Ticket Tracking v2 - ExtraHop - Ticket Tracking v2 ExtraHop - Ticket Trackin... ExtraHop - Ticket Tracking v2 Add initial investigation notes Add initial investigation... Detection Playbooks Detection Playbooks Ticket Tracking Ticket Tracking Does the detection have a playbook? Does the detection have a... ExtraHop - CVE-2019-0708 (BlueKeep) - ExtraHop - CVE-2019-0708 (BlueKeep) ExtraHop - CVE-2019-0708 ... ExtraHop - CVE-2019-0708 (Blu...