Incident Response - Infoblox Cloud

This playbook is used to initiate the incident response. This playbook runs when an incident is selected for investigation. It will change the state from pending to active and it will list the available indicators, events, assets, and comments from Infoblox corresponding to the incident. If incident severity is found to be higher than or equivalent to medium, it will create a ServiceNow incident otherwise the given incident will be assigned to an analyst.

Infoblox Threat Defense with DDI · 18 tasks · 4 inputs · 0 outputs

Inputs

  • soc_insight_id — Collect incident severity from incident.
  • incident_severity — Collect incident severity from incident.
  • limit — No of indicators, events, assets or comments to fetch of the provided SOC Insight.
  • onCall — Set to true to assign only the user that is currently on shift. Default is False.

Commands used

infobloxcloud-soc-insight-asset-list infobloxcloud-soc-insight-comment-list infobloxcloud-soc-insight-event-list infobloxcloud-soc-insight-indicator-list servicenow-update-ticket

Flowchart

no yes yes yes Start Start Extract SOC Insight id and collect SOC Insight details Extract SOC Insight id an... Collect SOC Insight indicators from provided SOC Insight id - infobloxcloud-soc-insight-indicator-list Collect SOC Insight indic... infobloxcloud-soc-insight-ind... Collect SOC Insight events from provided SOC Insight id - infobloxcloud-soc-insight-event-list Collect SOC Insight event... infobloxcloud-soc-insight-eve... Collect SOC Insight assets from provided SOC Insight id - infobloxcloud-soc-insight-asset-list Collect SOC Insight asset... infobloxcloud-soc-insight-ass... Check for incident severity Check for incident severity Collect SOC Insight comments from provided SOC Insight id - infobloxcloud-soc-insight-comment-list Collect SOC Insight comme... infobloxcloud-soc-insight-com... Assign an analyst to the incident - AssignAnalystToIncident Assign an analyst to the ... AssignAnalystToIncident Create ServiceNow Ticket - Create ServiceNow Ticket Create ServiceNow Ticket Create ServiceNow Ticket Done Done Extract incident severity and trigger corresponding tasks Extract incident severity... Update description of ServiceNow ticket - servicenow-update-ticket Update description of Ser... servicenow-update-ticket Extract indicator details for ticket description - SetAndHandleEmpty Extract indicator details... SetAndHandleEmpty Extract event details for ticket description - SetAndHandleEmpty Extract event details for... SetAndHandleEmpty Extract asset details for ticket description - SetAndHandleEmpty Extract asset details for... SetAndHandleEmpty Extract comment details for ticket description - SetAndHandleEmpty Extract comment details f... SetAndHandleEmpty Is Infoblox Threat Defense with DDI integration enabled? Is Infoblox Threat Defens... Is ServiceNow v2 integration enabled? Is ServiceNow v2 integrat...