Phishing Investigation - Generic Deprecated Hidden

Deprecated. Use "Phishing Investigation - Generic v2" playbook instead. Use this playbook to investigate and remediate a potential phishing incident. The playbook simultaneously engages with the user that triggered the incident, while investigating the incident itself. The final remediation tasks are always decided by a human analyst.

Deprecated Content (Deprecated) · 32 tasks · 4 inputs · 0 outputs

Inputs

  • Role — The default role to assign the incident to.
  • SearchAndDelete — Enable the "Search and Delete" capability (can be either "True" or "False"). In case of a malicious email, the "Search and Delete" sub-playbook will look for other instances of the email and delete them pending analyst approval.
  • BlockIndicators — Enable the "Block Indicators" capability (can be either "True" or "False"). In case of a malicious email, the "Block Indicators" sub-playbook will block all malicious indicators in the relevant integrations.
  • OnCall — Set to true to assign only user that is currently on shift

Commands used

closeInvestigation send-mail

Flowchart

Malicious No Yes yes yes Start Start Assign to analyst - AssignAnalystToIncident Assign to analyst AssignAnalystToIncident 6 - Calculate Severity - Generic 6 Calculate Severity - Generic Manually review the incident Manually review the incident Close investigation - closeInvestigation Close investigation closeInvestigation Triage Triage Store the email address of the reporting user - Set Store the email address o... Set Acknowledge incident was received - send-mail Acknowledge incident was ... send-mail Email Address Enrichment - Generic - Email Address Enrichment - Generic Email Address Enrichment ... Email Address Enrichment - Ge... Is the email malicious? Is the email malicious? Update the user that the reported email is safe - SendEmail Update the user that the... SendEmail Update the user that the reported email is malicious - send-mail Update the user that the... send-mail Engage with User Engage with User Detonate File - Generic - Detonate File - Generic Detonate File - Generic Detonate File - Generic Entity Enrichment - Generic - Entity Enrichment - Generic Entity Enrichment - Generic Entity Enrichment - Generic Process Email - Generic - Process Email - Generic Process Email - Generic Process Email - Generic Remediate Remediate Search And Delete Emails - Generic - Search And Delete Emails - Generic Search And Delete Emails ... Search And Delete Emails - Ge... Done Done Malicious Malicious Undetermined Undetermined Is the email malicious? Is the email malicious? Manually remediate the incident Manually remediate the i... Extract Indicators From File - Generic - Extract Indicators From File - Generic Extract Indicators From F... Extract Indicators From File ... Execute the "Search and Delete" sub-playbook? Execute the "Search and D... Execute the "Block Indicators" sub-playbook? Execute the "Block Indica... Block Indicators - Generic - Block Indicators - Generic Block Indicators - Generic Block Indicators - Generic Start Detection Timer Start Detection Timer Stop Detection Timer Stop Detection Timer Stop Detection Timer Stop Detection Timer Start Remediation Timer Start Remediation Timer Stop Remediation Timer Stop Remediation Timer