HackerView Incident Management

This playbook runs the incidents through indicator enrichment, then based on the mirroring settings, it can communicate with the remote server to track the progress of the investigation.

CTM360 · 14 tasks · 0 inputs · 0 outputs

Details

IDHackerView Incident Management
From Version6.10.0
Tasks14

README

This playbook runs the incidents through indicator enrichment, then based on the mirroring settings, it can communicate with the remote server to track the progress of the investigation.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

  • Entity Enrichment - Generic v3

Integrations

  • CTM360_HackerView

Scripts

  • Print
  • AssignAnalystToIncident

Commands

  • ctm360-hv-incident-status-change
  • ctm360-hv-incident-details
  • closeInvestigation

Playbook Inputs

There are no inputs for this playbook.

Playbook Outputs

There are no outputs for this playbook.

Playbook Image

HackerView Incident Management

Commands used

closeInvestigation ctm360-hv-incident-details ctm360-hv-incident-status-change

Flowchart

yes A False Positive An Acceptable Risk No Action Resolution Complete Resolution in Progress Start Investigation yes Start Start Get Incident Remote Status - ctm360-hv-incident-details Get Incident Remote Status ctm360-hv-incident-details Is The Incident Closed? Is The Incident Closed? Close Incident Locally - closeInvestigation Close Incident Locally closeInvestigation Start Investigation - ctm360-hv-incident-status-change Start Investigation ctm360-hv-incident-status-change End of Playbook End of Playbook Assign Analyst - AssignAnalystToIncident Assign Analyst AssignAnalystToIncident Prompt User to advance the progress of the incident response. Prompt User to advance th... Entity Enrichment - Generic v3 - Entity Enrichment - Generic v3 Entity Enrichment - Gener... Entity Enrichment - Generic v3 Check if Incoming Mirroring is Enabled Check if Incoming Mirrori... Resolution in Progress - ctm360-hv-incident-status-change Resolution in Progress ctm360-hv-incident-status-change Resolution Complete - ctm360-hv-incident-status-change Resolution Complete ctm360-hv-incident-status-change An Acceptable Risk - ctm360-hv-incident-status-change An Acceptable Risk ctm360-hv-incident-status-change A False Positive - ctm360-hv-incident-status-change A False Positive ctm360-hv-incident-status-change

Source

playbook-HackerView_Incident_Management.yml playbook-HackerView_Incident_Management_V2.yml playbook-HackerView_Incident_Management_V2_README.md
Download History Raw 
This playbook runs the incidents through indicator enrichment, then based on the mirroring settings, it can communicate with the remote server to track the progress of the investigation.

When the remote HackerView ticket status becomes **inactive**, the playbook automatically closes the local incident (`Close Incident Locally` → `closeInvestigation`). The HackerView Incident type runs this playbook with **autorun** enabled, so that auto-close path does not wait for analyst input.

## Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

### Sub-playbooks

* Entity Enrichment - Generic v3

### Integrations

* CTM360_HackerView

### Scripts

* AssignAnalystToIncident
* GetEnabledInstances
* IsIntegrationAvailable

### Commands

* closeInvestigation
* ctm360-hv-incident-details
* ctm360-hv-incident-status-change

## Playbook Inputs

---
| **Name** | **Description** | **Default Value** | **Required** |
| --- | --- | --- | --- |
| closeReason | The reason recorded when the playbook closes the local incident after the remote HackerView ticket becomes inactive. | Incident closed by DBot via playbook | Optional |

## Playbook Outputs

---
There are no outputs for this playbook.

## Playbook Image

---

![HackerView Incident Management V2](../doc_files/HackerView_Incident_Management_V2.png)