Illusive-Retrieve-Incident

This playbook is used for retrieving an extensive view over a detected incident by retrieving the incident details and a forensics timeline if and when forensics have been successfully collected.

Illusive Networks · 6 tasks · 3 inputs · 8 outputs

Inputs

  • incident_id — The desired incident ID to retrieve.
  • start_date — The starting date of the forensics timeline.
  • end_date — The last date of the forensics timeline.

Outputs

  • Illusive.Forensics.Evidence.details — The forensics evidence details
  • Illusive.Forensics.Evidence.eventId — The event ID
  • Illusive.Forensics.Evidence.id — The forensics evidence ID
  • Illusive.Forensics.Evidence.source — The Evidence source
  • Illusive.Forensics.Evidence.starred — Whether the forensics evidence has been starred
  • Illusive.Forensics.Evidence.time — Date and time of the forensics evidence
  • Illusive.Forensics.Evidence.title — The forensics evidence description
  • Illusive.Forensics.IncidentId — The Incident Id

Commands used

illusive-get-forensics-timeline illusive-get-incidents

Flowchart

yes Start Start illusive-get-incidents - illusive-get-incidents illusive-get-incidents illusive-get-incidents Check If Incident Has Forensics Check If Incident Has For... illusive-get-forensics-timeline - illusive-get-forensics-timeline illusive-get-forensics-ti... illusive-get-forensics-timeline Print No Forensics Timeline for Incident - Print Print No Forensics Timeli... Print Print Incident Forensics Timeline - Print Print Incident Forensics ... Print