‎Investigation Playbook Triggers

Commands used to for event-incident correlation:

• Create Incident

• Create Incident with Conditions

• Add Playbook to Incidents

SCENARIO A manager has requested to be notified whenever an incident is created. To fulfill this request, the analyst will perform the following tasks.

Task 1: Add the Send Email Utility Command

The analyst will begin by adding the Send Email utility command task to the On Playbook Start trigger in an investigation playbook.

1. Add the Send Email utility command to the trigger.

   

2. Configure the fields as necessary.

   

   1. Enter the task name.

   2. Input the manager’s email address.

   3. Enter the email subject.

   4. Enter the email body containing a static message combined with the dynamically retrieved incident number.

      CODE

      {{ "A new incident has been created: " ~ (PlaybookData | jsonpath('$.DataSource.incident.IncidentNo')) }}

3. Check the Auto Run checkbox, then click on the button to save.

   

4. Click on the Submit button, then confirm the playbook submission.

   

5. Click on the Publish button, select a site to which to publish the playbook, then click on the Save button.

   

Task 2: Use the Investigation Playbook in a Preprocessing Playbook

After publishing the investigation playbook, the analyst will use it in an escalate task within a preprocessing playbook. They have already completed most of the preprocessing playbook workflow, with only the escalate task remaining to be configured.

1. Click into the escalate task.

   

2. Configure the fields as necessary.

   

   1. Enter the task name.

   2. Select an incident type.

   3. Select the previously created investigation playbook.

3. Check the Auto Run checkbox, then click on the button to save.

   

RESULT

Whenever a new incident is created through the preprocessing playbook, the investigation playbook configured in task 1 will execute automatically.

1. Create a Codeless Playbook utility command.

   

2. Setup a task that would result in an error.

   

3. Enable its use as a command task.

   

4. Use a passdown task to emit an error message to the parent playbook.

   

5. Submit this utility command.

   

6. Create an incident (investigation) playbook.

   

7. Set up the Demo Nested Playbook Utility Command task.

   

READER NOTE

Ensure that the Error Trigger checkbox is ticked.

8. Set up a Send Email utility command task for the On Playbook Task Error trigger.

   

9. Test run this playbook, ensuring that the Demo Nested Playbook Utility Command task results in , and the Send Email task results in .

   

10. Check the email for the error message.

    

• Changing the site

• Changing the title

• Changing the severity

• Changing the owner

• Changing the date occurred

• Changing the disposition

• Changing the incident type

• Changing the date ended

• Adding a custom field

• Modifying a custom field’s value

• Deleting a custom field

• Adding a description

• Modifying a description

• Deleting a description

• Adding a conclusion

• Modifying a conclusion

• Deleting a conclusion

• Adding a Tactic & Technique / Adversary Lifecycle

• Deleting a Tactic & Technique / Adversary Lifecycle

• Adding a playbook

• Deleting a playbook

• Adding investigation team members

• Deleting investigation team members

• Adding files

• Deleting files

• Adding notes

• Modifying notes

• Deleting notes

• Inputting dynamic field values

• Modifying/Clearing and saving dynamic field values

• Adding a JSON table

• Modifying a JSON table

• Deleting a JSON table

• Adding tags

• Deleting tags

1. Create a Demo Trigger investigation playbook with an auto-running task connected to the On Incident External Action trigger.

   

2. Submit the playbook.

   

3. Publish the playbook.

   

4. Create three incident having the following characteristics:

   1. Title: Demo Incident 1, 2, or 3

   2. Type: Suspicious Network Activity

   3. Severity: Medium

      

      

5. Ensure the Demo Trigger investigation playbook is attached to each incident.

   

6. Navigate to the Trigger Incident External Action utility command.

   

7. Test the utility command with the following for the Search Condition input parameter:

   JSON

   {
       "Type": "Suspicious Network Activity",
       "Severity": "Medium",
       "Title": {
           "$regex": "Demo Incident"
       }
   }

   

8. Verify that the Demo Trigger playbook has completed execution only within the first incident (Demo Incident 1).