Ransomware Response

This trigger is responsible for handling ransomware alerts

Details

ID	`437fc412eafbec9c69d8af8322895b69`
Runs Playbook	Ransomware Response
Suggestion Reason	Recommended for Alerts triggered by the Anti Ransomware module

Source

Trigger_-_Ransomware_Response.json

Download History Raw

{
  "trigger_id": "437fc412eafbec9c69d8af8322895b69",
  "playbook_id": "Ransomware Response",
  "suggestion_reason": "Recommended for Alerts triggered by the Anti Ransomware module",
  "description": "This trigger is responsible for handling ransomware alerts",
  "trigger_name": "Ransomware Response",
  "alerts_filter": {
    "filter": {
      "OR": [
        {
          "SEARCH_FIELD": "mitre_technique_id_and_name",
          "SEARCH_TYPE": "CONTAINS",
          "SEARCH_VALUE": "T1486 - Data Encrypted for Impact"
        }
      ]
    }
  },
  "supportedModules": [
    "xsiam",
    "agentix"
  ]
}