HackerView Incident Management

This playbook runs the incidents through indicator enrichment, then based on the mirroring settings, it can communicate with the remote server to track the progress of the investigation.

CTM360 · 14 tasks · 0 inputs · 0 outputs

Commands used

closeInvestigation ctm360-hv-incident-details ctm360-hv-incident-status-change

Flowchart

yes A False Positive An Acceptable Risk No Action Resolution Complete Resolution in Progress Start Investigation yes Start Start Get Incident Remote Status - ctm360-hv-incident-details Get Incident Remote Status ctm360-hv-incident-details Is The Incident Closed? Is The Incident Closed? Close Incident Locally - closeInvestigation Close Incident Locally closeInvestigation Start Investigation - ctm360-hv-incident-status-change Start Investigation ctm360-hv-incident-status-change End of Playbook End of Playbook Assign Analyst - AssignAnalystToIncident Assign Analyst AssignAnalystToIncident Prompt User to advance the progress of the incident response. Prompt User to advance th... Entity Enrichment - Generic v3 - Entity Enrichment - Generic v3 Entity Enrichment - Gener... Entity Enrichment - Generic v3 Check if Incoming Mirroring is Enabled Check if Incoming Mirrori... Resolution in Progress - ctm360-hv-incident-status-change Resolution in Progress ctm360-hv-incident-status-change Resolution Complete - ctm360-hv-incident-status-change Resolution Complete ctm360-hv-incident-status-change An Acceptable Risk - ctm360-hv-incident-status-change An Acceptable Risk ctm360-hv-incident-status-change A False Positive - ctm360-hv-incident-status-change A False Positive ctm360-hv-incident-status-change