SOCRadar Incident

Performs indicator extraction and enrichment from the incident content, calculates the severity level, assigns the incident to a particular analyst, notifies SOCRadar platform for the incident response (to mark it as false positive or resolved) and generates investigation summary report just before closing the investigation in the end. This playbook is executed for the SOCRadar Generic incident type.

SOCRadar · 21 tasks · 1 input · 0 outputs

Inputs

  • AutoEnrich — Auto Enrich input to be used for extracting indicators out of the incident content automatically at the beginning of the playbook. (Options: Yes/No)

Commands used

closeInvestigation extractIndicators setIncident socradar-mark-incident-fp socradar-mark-incident-resolved

Flowchart

no yes NO Yes no yes Start Start Extract Encountered Indicators - extractIndicators Extract Encountered Indic... extractIndicators Should indicators be extracted and enriched? Should indicators be extr... Extract & Enrich Indicators Extract & Enrich Indicators Entity Enrichment - Generic v3 - Entity Enrichment - Generic v3 Entity Enrichment - Gener... Entity Enrichment - Generic v3 Incident Investigation Incident Investigation Assign Incident to Analyst - AssignAnalystToIncident Assign Incident to Analyst AssignAnalystToIncident Manually review the incident. Manually review the incid... Action Decision Action Decision Is this incident false positive? Is this incident false po... Generate Investigation Summary Report - GenerateInvestigationSummaryReport Generate Investigation Su... GenerateInvestigationSummaryR... Close Investigation - closeInvestigation Close Investigation closeInvestigation Done Done Mark as False Positive - setIncident Mark as False Positive setIncident Mark as Resolved - setIncident Mark as Resolved setIncident False Positive Actions False Positive Actions True Positive Actions True Positive Actions Set Incident as False Positive in SOCRadar - socradar-mark-incident-fp Set Incident as False Pos... socradar-mark-incident-fp Set Incident as Resolved in SOCRadar - socradar-mark-incident-resolved Set Incident as Resolved ... socradar-mark-incident-resolved Decide on action Decide on action Is SOCRadar Incidents enabled? - IsIntegrationAvailable Is SOCRadar Incidents ena... IsIntegrationAvailable