Google Dorking File Processing

This playbook processes files fetched by the Google Dorking integration. The SOC will track the file owner and classify the exposed data and users in order to contained the leaked data.

Google Dorking · 44 tasks · 4 inputs · 0 outputs

Inputs

  • ExclusionListName — An XSOAR list to exclude files by hash
  • SeverityMapping —
  • ComplianceMailAddress —
  • ITMailAddress —

Commands used

addToList closeInvestigation extractIndicators rasterize send-mail setIncident

Flowchart

No YES Custom GDPR HIPPA US Yes NO YES Non sensitive Sensitive data Sensitive data Found yes YES YES yes Start Start Does the file need to be removed? Does the file need to be ... Non sensetive data Non sensetive data Add file SHA256 to exclusion list - addToList Add file SHA256 to exclus... addToList Does data require compliance? Does data require complia... Compliance Compliance IT Operations IT Operations Are there breached service accounts? Are there breached servic... Notify IT to reset all detected credentials - send-mail Notify IT to reset all de... send-mail Notify IT to replace service accounts - send-mail Notify IT to replace serv... send-mail Revoke API keys - send-mail Revoke API keys send-mail Is the data owner known? Is the data owner known? Data owner details Data owner details Track data owner Track data owner Validate data classification Validate data classification Set severity - setIncident Set severity setIncident Course of action Course of action Close investigation - closeInvestigation Close investigation closeInvestigation Close Close Done Done Remove file from google indexing Remove file from google i... Notify data owner Notify data owner Owner found? Owner found? Set severity - setIncident Set severity setIncident Rasterize file - rasterize Rasterize file rasterize Present Data Present Data Read data - ReadFile Read data ReadFile Data Owner and Classification Data Owner and Classifica... Create custom notification incident Create custom notificatio... Confirm remediation is complete Confirm remediation is co... Set Data Owner Details - setIncident Set Data Owner Details setIncident Get data classification from data owner - setIncident Get data classification f... setIncident Extract usernames - ExtractUsernames Extract usernames ExtractUsernames Exclusion Exclusion Was a file hash list provided? Was a file hash list prov... File Excluded close incident File Excluded close incident Are there breached API keys? Are there breached API keys? Are there breached user accounts? Are there breached user a... Run filter by list - FilterByList Run filter by list FilterByList Is the file in the exclusion list? Is the file in the exclus... GDPR Breach Notification - GDPR Breach Notification GDPR Breach Notification GDPR Breach Notification HIPAA - Breach Notification - HIPAA - Breach Notification HIPAA - Breach Notification HIPAA - Breach Notification US - Breach Notification - US - Breach Notification US - Breach Notification US - Breach Notification Extract indicators - extractIndicators Extract indicators extractIndicators