Slack - General Failed Logins v2.1

Investigates a failed login event. The playbook interacts with the user via the Slack integration, checks whether the logins were a result of the user's attempts or an attack, raises the severity, and expires the user's password according to the user's replies.

Slack · 11 tasks · 1 input · 0 outputs

Inputs

  • UsernameOrEmail — The username or the email address of the user who failed to login.

Commands used

ad-expire-password closeInvestigation send-notification setIncident

Flowchart

No Yes No yes yes yes start_task start_task Ask user to confirm failed login attempts Ask user to confirm faile... Raise Incident Severity to High - setIncident Raise Incident Severity t... setIncident Should we reset the password? Should we reset the passw... Expire Password - ad-expire-password Expire Password ad-expire-password Notify User on Slack - send-notification Notify User on Slack send-notification Close the incident - closeInvestigation Close the incident closeInvestigation Is Slack v2 enabled? Is Slack v2 enabled? Done Done Is Active Directory Query v2 enabled? Is Active Directory Query... Reset the user password Reset the user password