Report Categorization - Cofense Triage v3

Report Categorization playbook investigates reports that are unprocessed or uncategorized on Cofense Triage as incident alerts in XSOAR and categorizes them based on the severity of the incident.

Cofense Triage · 23 tasks · 5 inputs · 0 outputs

Inputs

  • OnCall — Set to true to assign only user that is currently on shift. Requires Cortex XSOAR v5.5 or later.
  • ReportID — Requires report ID to investigate and categorize the report that is pulled from Cofense Triage.
  • AutoCategorize — Whether the user wants to categorize the report automatically or not.
  • MaliciousCategory — The category to be assigned to the report if it is malicious.
  • NonMaliciousCategory — The category to be assigned to the report if it is non-malicious.

Commands used

cofense-category-list cofense-report-categorize cofense-report-download extractIndicators rasterize-email rasterize-image

Flowchart

no yes Malicious Non-Malicious yes yes yes yes Start Start Assign analyst to incident - AssignAnalystToIncident Assign analyst to incident AssignAnalystToIncident Extract indicators from incident - extractIndicators Extract indicators from i... extractIndicators Calculate Severity - Generic v2 - Calculate Severity - Generic v2 Calculate Severity - Gene... Calculate Severity - Generic v2 Done Done Report Download - cofense-report-download Report Download cofense-report-download Parse Email - ParseEmailFiles Parse Email ParseEmailFiles Rasterize Email - rasterize-email Rasterize Email rasterize-email Rasterize Attachments - rasterize-image Rasterize Attachments rasterize-image Check Email Authenticity - CheckEmailAuthenticity Check Email Authenticity CheckEmailAuthenticity Send Indicators - Cofense Triage v3 - Send Indicators - Cofense Triage v3 Send Indicators - Cofense... Send Indicators - Cofense Tri... Is Category ID empty? Is Category ID empty? Categorize Report - cofense-report-categorize Categorize Report cofense-report-categorize Is AutoCategorize true? Is AutoCategorize true? Is Email Malicious or Non-Malicious? Is Email Malicious or Non... Get Category ID - cofense-category-list Get Category ID cofense-category-list Provide a category to categorize a report as malicious Provide a category to cat... Get Category ID - cofense-category-list Get Category ID cofense-category-list Get Category ID - cofense-category-list Get Category ID cofense-category-list Provide a category to categorize a report as non-malicious Provide a category to cat... Is AutoCategorize true? Is AutoCategorize true? Is Cofense Triage v3 Integration Enable? Is Cofense Triage v3 Inte... Is Rasterize Integration Enable? Is Rasterize Integration ...