Recorded Future Identity - Identity Found (incident) Deprecated

Deprecated. Use Recorded Future - Identity Exposure instead. This playbook was developed as a template response when an Identity has been found and a Recorded Future Identity Incident has been created.

Recorded Future Identity · 15 tasks · 0 inputs · 0 outputs

Commands used

ad-disable-account ad-expire-password ad-get-user closeInvestigation recordedfuture-identity-lookup

Flowchart

YES yes no yes Start Start Query Specific Identity - recordedfuture-identity-lookup Query Specific Identity recordedfuture-identity-lookup Check AD if account is Active - ad-get-user Check AD if account is Ac... ad-get-user Analyst Prompt | Review Identity Information Analyst Prompt | Review I... True Positive? True Positive? Disable AD account - ad-disable-account Disable AD account ad-disable-account Close Incident - closeInvestigation Close Incident closeInvestigation Create Ticket in IM System & Contact User Create Ticket in IM Syste... Analyst Prompt | Take Automated Action? Analyst Prompt | Take Aut... Automate IR? Automate IR? Manual Response Manual Response Expire Password - ad-expire-password Expire Password ad-expire-password Done Done Is Active Directory integration available - IsIntegrationAvailable Is Active Directory integ... IsIntegrationAvailable Review account Review account