Proactive Threat Hunting - Entity Enrichment

This playbook will be executed from the "Proactive Threat Hunting" layout button with the objective of enriching information on hosts and users specified by the analyst.

Proactive Threat Hunting · 30 tasks · 0 inputs · 0 outputs

Commands used

endpoint setIncident xdr-get-alerts

Flowchart

yes yes yes yes yes yes yes Start Start Print update to notes - Print Print update to notes Print Endpoint enrichment - endpoint Endpoint enrichment endpoint Has endpoint enrichment results Has endpoint enrichment r... Choose entities to enrich Choose entities to enrich Set endpoint enrichment data to layout - JsonToTable Set endpoint enrichment d... JsonToTable Endpoint Details Endpoint Details Alerts Related To The Endpoint Alerts Related To The End... Related alerts found? Related alerts found? Set related alerts to layout - JsonToTable Set related alerts to layout JsonToTable Search alerts related to endpoint - xdr-get-alerts Search alerts related to ... xdr-get-alerts Endpoint Enrichment Endpoint Enrichment User Enrichments User Enrichments User Details User Details Account Enrichment - Generic v2.1 - Account Enrichment - Generic v2.1 Account Enrichment - Gene... Account Enrichment - Generic ... Alerts Related To The User Alerts Related To The User Search alerts related to endpoint - xdr-get-alerts Search alerts related to ... xdr-get-alerts Done Done Has user to enrich? Has user to enrich? User Enrichment Completed User Enrichment Completed Has endpoint to enrich? Has endpoint to enrich? Endpoint Enrichment Completed Endpoint Enrichment Compl... Has user enrichment results? Has user enrichment results? Set user enrichment data to layout - JsonToTable Set user enrichment data ... JsonToTable Set results without empty fields - Set Set results without empty... Set Delete context to avoid duplications - endpointsdetailsmarkdown - DeleteContext Delete context to avoid d... DeleteContext Delete context to avoid duplications - relatedalertsmarkdown - DeleteContext Delete context to avoid d... DeleteContext Set no results found - setIncident Set no results found setIncident Set no results found - setIncident Set no results found setIncident Set no results found - setIncident Set no results found setIncident