Failed Login Playbook - Slack v2 Deprecated Hidden

Deprecated. Use the Slack - General Failed Logins v2.1 playbook. When there are three failed login attempts to Demisto that originate from the same user ID, a direct message is sent to the user on Slack requesting that they confirm the activity. If the reply is "no", then the incident severity is set to "high". If the reply is "yes", then another direct message is sent to the user asking if they require a password reset in AD.

Deprecated Content (Deprecated) · 9 tasks · 0 inputs · 0 outputs

Commands used

ad-expire-password closeInvestigation send-notification setIncident

Flowchart

no yes no yes start_task start_task Ask user to confirm failed login attempts - SlackAsk Ask user to confirm faile... SlackAsk Did the user attempt the failed login attempts? Did the user attempt the ... Raise Incident Severity to High - setIncident Raise Incident Severity t... setIncident Ask the user if we should reset their password - SlackAsk Ask the user if we should... SlackAsk Should we reset the password? Should we reset the passw... Expire Password - ad-expire-password Expire Password ad-expire-password Notify User on Slack - send-notification Notify User on Slack send-notification Close the incident - closeInvestigation Close the incident closeInvestigation