Investigate On Bad Domain Matches - Chronicle

Use this playbook to investigate and remediate Bad IOC domain matches with recent activity found in the enterprise, as well as notify the SOC lead and network team about the matches. Supported Integrations: - Chronicle - Google SecOps - Whois - Mail Sender (New) - Palo Alto Networks PAN-OS - Palo Alto Networks AutoFocus v2

Google SecOps · 30 tasks · 2 inputs · 0 outputs

Inputs

  • networkteam_email — Enter the email address of the network team that needs to be notified.
  • stakeholder_email — Enter the email of the stakeholder to whom you want to send the investigation summary report.

Commands used

domain gcb-assets gcb-ioc-details pan-os-register-user-tag send-mail whois

Flowchart

Benign yes yes yes yes yes yes yes yes yes yes yes yes Start Start Perform domain reputation check using Autofocus - domain Perform domain reputation... domain Done Done Get list of assets that connected to the suspicious domain - gcb-assets Get list of assets that c... gcb-assets Is the domain benign? Is the domain benign? Assign analyst to incident - AssignAnalystToIncident Assign analyst to incident AssignAnalystToIncident Notify network team - send-mail Notify network team send-mail Perform Final Review Perform Final Review Generate investigation summary report - GenerateInvestigationSummaryReport Generate investigation su... GenerateInvestigationSummaryR... Get IOC details from Chronicle - gcb-ioc-details Get IOC details from Chro... gcb-ioc-details Email the report to stakeholders - send-mail Email the report to stake... send-mail Perform domain reputation check using Chronicle - domain Perform domain reputation... domain Get userid and tagname via email Get userid and tagname vi... Apply user tag at the firewall - pan-os-register-user-tag Apply user tag at the fir... pan-os-register-user-tag Get WhoIs information - whois Get WhoIs information whois Get hostnames - Print Get hostnames Print Print category - Print Print category Print Is Palo Alto Networks AutoFocus v2 integration enabled? Is Palo Alto Networks Aut... Is Whois integration enabled? Is Whois integration enab... Is the Chronicle or Google SecOps integration enabled? Is the Chronicle or Googl... Is Palo Alto Networks PAN-OS integration enabled? Is Palo Alto Networks PAN... Is Mail Sender integration enabled? Is Mail Sender integratio... Is Mail Sender integration enabled? Is Mail Sender integratio... Is network team email address set? Is network team email add... Get userid and tagname Get userid and tagname Is Stakeholder email address set? Is Stakeholder email addr... Get stakeholder email address. Get stakeholder email add... Email the report to stakeholders - send-mail Email the report to stake... send-mail Is hostname found? Is hostname found? Is Chronicle integration enabled? Is Chronicle integration ...