Recorded Future - Identity Exposure

This playbook was developed as a template response when an Identity Exposure Playbook Alert has been triggered.

Recorded Future Identity · 24 tasks · 0 inputs · 0 outputs

Commands used

ad-disable-account ad-expire-password ad-get-user closeInvestigation okta-add-to-group okta-search okta-suspend-user recordedfuture-identity-playbook-alerts-update

Flowchart

YES AD Okta no yes no yes yes Start Start Check AD for active account - ad-get-user Check AD for active account ad-get-user Analyst Prompt | Review Account Information Analyst Prompt | Review A... True Positive? True Positive? Disable AD account - ad-disable-account Disable AD account ad-disable-account Close Incident - closeInvestigation Close Incident closeInvestigation Create ticket in IM system Create ticket in IM system Analyst Prompt | Take Automated Action? Analyst Prompt | Take Aut... Automate IR? Automate IR? Manual response Manual response Expire password - ad-expire-password Expire password ad-expire-password Done Done Is Active Directory integration available - IsIntegrationAvailable Is Active Directory integ... IsIntegrationAvailable Is Okta integration available - IsIntegrationAvailable Is Okta integration avail... IsIntegrationAvailable Check Okta for active account - okta-search Check Okta for active acc... okta-search Suspend Okta user - okta-suspend-user Suspend Okta user okta-suspend-user Add user to Compromised group - okta-add-to-group Add user to Compromised g... okta-add-to-group Review account manually Review account manually Integration was available? Integration was available? Set Recorded Future alert to 'in-progress' - recordedfuture-identity-playbook-alerts-update Set Recorded Future alert... recordedfuture-identity-playb... Analyst Prompt | Select Resolving Action Analyst Prompt | Select R... Set Recorded Future alert to 'resolved' - recordedfuture-identity-playbook-alerts-update Set Recorded Future alert... recordedfuture-identity-playb... Contact user or user's manager Contact user or user's ma... Close Incident - closeInvestigation Close Incident closeInvestigation