TIM - Indicator Relationships Analysis

This playbook is designed to assist with a security investigation by providing an analysis of indicator relationships. The following information is included: - Indicators of compromise (IOCs) related to the investigation. - Attack patterns related to the investigation. - Campaigns related to the investigation. - IOCs associated with the identified campaigns. - Reports containing details on the identified campaigns.

TIM - Indicator Auto-Processing · 20 tasks · 2 inputs · 7 outputs

Inputs

  • Indicator — Input an indicator to analyze its relationships.
  • LimitResults — The number of results to return. If the input is empty, the limit will be 20.

Outputs

  • RelatedAttackPatterns — Attack patterns related to the indicator.
  • RelatedCampaign — Campaign related to the indicator.
  • RelatedReport — Report related to the campaign.
  • RelatedFiles — Files related to the indicator and campaign.
  • RelatedDomains — Domains related to the indicator and campaign.
  • RelatedIPs — IPs related to the indicator and campaign.
  • RelatedURLs — URLs related to the indicator and campaign.

Flowchart

yes yes yes yes yes yes yes yes Start Start Has related campaign? Has related campaign? Set related files - Set Set related files Set Set related IPs - Set Set related IPs Set Set related Domains - Set Set related Domains Set Set related URLs - Set Set related URLs Set Is there a File type indicators? Is there a File type indi... Is there a URL type indicators? Is there a URL type indic... Is there a Domain type indicators? Is there a Domain type in... Is there a IP type indicators? Is there a IP type indica... Done Done Get Indicator Relationships - SearchIndicatorRelationships Get Indicator Relationships SearchIndicatorRelationships Get Campaign related indicators - SearchIndicatorRelationships Get Campaign related indi... SearchIndicatorRelationships Set Related Campaign - Set Set Related Campaign Set Set Indicators Set Indicators Has reports? Has reports? Set Report - Set Set Report Set Has Related Attack Patterns? Has Related Attack Patterns? Set Related Attack Patterns - Set Set Related Attack Patterns Set Has Indicator? Has Indicator?