Splunk Generic

This is a generic playbook to be executed for the Splunk Notable Generic incident type. The playbook performs all the common parts of the investigation, including notifying the SOC, enriching the data for indicators and users, calculating the severity, assigning the incident, notifying the SIEM admin for false positives and more.

Splunk · 24 tasks · 7 inputs · 0 outputs

Inputs

  • Enrich — Determines whether to enrich all indicators in the incident. Default is True.
  • OnCall — Set to true to assign only the user that is currently on shift. Default is False. Requires Cortex XSOAR v5.5 or later.
  • SocEmailAddress — The SOC team's email address.
  • SocMailSubject — The subject of the email to send to the SOC.
  • SiemAdminEmailAddress — The SIEM admin's email address.
  • UseCalculateSeverity — Determines whether to use the Calculate Severity playbook to calculate the incident severity. Default is True. If the playbook isn't used, the severity is determined by the Splunk severity value.
  • SiemAdminMailSubject — The subject of the email to send to the SIEM admin.

Commands used

closeInvestigation extractIndicators send-mail setIncident

Flowchart

yes False Positive True Positive yes yes yes Start Start Should indicators be extracted and enriched? Should indicators be extr... Start Remediation SLA Timer Start Remediation SLA Timer Enrich Data Enrich Data Manually review the incident Manually review the incident Close investigation - closeInvestigation Close investigation closeInvestigation Extract indicators from incident - extractIndicators Extract indicators from i... extractIndicators Entity Enrichment - Generic v2 - Entity Enrichment - Generic v2 Entity Enrichment - Gener... Entity Enrichment - Generic v2 Done Done Send investigation report to SOC - send-mail Send investigation report... send-mail Was this a true positive? Was this a true positive? Generate Investigation Summary Report - GenerateInvestigationSummaryReport Generate Investigation Su... GenerateInvestigationSummaryR... Use Calculate Severity? Use Calculate Severity? Was the SOC email address provided? Was the SOC email address... Was the SIEM admin email address provided? Was the SIEM admin email ... Assign an analyst to the incident - AssignAnalystToIncident Assign an analyst to the ... AssignAnalystToIncident Post Incident Activity Post Incident Activity Provide data for rule adjustment Provide data for rule adj... Send email to SIEM admin - send-mail Send email to SIEM admin send-mail Investigation Investigation Set as false positive - setIncident Set as false positive setIncident SIEM Admin SIEM Admin SOC Summary SOC Summary Calculate Severity - Standard - Calculate Severity - Standard Calculate Severity - Stan... Calculate Severity - Standard