Playbook UX Enhancements

SCENARIO An analyst is creating a preprocessing playbook to evaluate the top-level domain (TLD) of emails from ingested Office 365 data. Events from whitelisted domains are dismissed, while others are escalated to incidents.

Task 1: Adding a Playbook

1. Add a Preprocessing Playbook.

   

   1. Navigate to Configuration.

   2. Click on the Preprocessing Playbook module.

   3. Click on the + Playbook button.

2. Enter a name for the playbook, then click on the OK button.

   

Task 2: Creating a Data Source

Create a data source to simplify the amount of configuration required to test the playbook upon its completion.

1. Select the Fetch data intake option, then click on the Next button.

   

2. Search for the Office 365 integration using the search bar, select it, then click on the Next button.

   

3. Select the site to use using the dropdown, then click on the Next button.

   

4. Choose an existing connection or create a new one, then click on the Next button.

   

5. Configure the command input values as necessary, then click on the Review button.

   

   Refer to the Fetch Event command for Office 365 for detailed information regarding its input parameters.

6. Click on the Submit button upon reviewing the test data.

   

For more information on creating a data source, refer to this documentation.

Task 3: Formatting the Ingested Data

Add a data formatter task to retrieve and process the email address from the ingested data.

1. Add a data formatter task to the On Event Ingestion trigger.

   

2. Name the task “Get Sender TLD”, then add the code provided in the code snippet:

   

   CODE

   {% set split_vals = PlaybookData | jsonpath('$.Trigger.data.Data.sender.emailAddress.address') | split('.') %}
   
   {{{
       "TLD": split_vals[-1]
       }}}

   This code extracts the email address from the ingested data, splits it into individual items separated by dots (.), and saves the result as an array. The TLD is extracted for use in Task 3 to check against a whitelist.

3. Ensure that auto run is enabled, then click on the button to save.

   

Task 4: Creating a Conditional Task

Use a conditional task to split the workflow into two paths: one for non-suspicious TLDs and one for suspicious TLDs.

1. Connect a conditional task to the previously configured data formatter task.

   

2. Enter a name for the task, ensure auto run is enabled, then click on the Condition Settings tab.

   

3. Select Dynamic Input using the dropdown, and then add the code provided in the code snippet:

   

   CODE

   {% set whitelist = ["com","org","edu"] %}
   
   {% if PlaybookData | jsonpath('$.["Get Sender TLD"].returnData.TLD') in whitelist %}
       {{"Not Suspicious TLD"}}
       {% else %}
       {{"Suspicious TLD"}}
   {% endif %}

   This code checks whether a sender's TLD is in a predefined whitelist. It retrieves the TLD from the data formatter task and outputs "Not Suspicious TLD" if found; otherwise, it outputs "Suspicious TLD."

4. Click on the Branch Settings tab, add the following branches: Not Suspicious TLD and Suspicious TLD, then click on the button to save.

   

Task 5: Dismissing Events with Whitelisted Domains

1. Connect a Dismiss task to the Not Suspicious TLD branch.

   

2. Enter a task name, ensure that auto run is enabled, then click on the button to save.

   

Task 6: Escalating Events Outside Whitelisted Domains

1. Connect an Escalate task to the Suspicious TLD branch.

   

2. Configure the Escalate task.

   

   1. Enter a name for the task.

   2. Select an incident type using the dropdown.

   3. Select an incident playbook to use on the incident upon escalating the event.

3. Ensure that auto run is enabled, then click on the button to save.

   

Task 7: Test the Playbook

With all tasks for the playbook configured, test it using the Test Playbook functionality.

1. Click on the Test Playbook button.

   

2. Select the previously created data source, and then click on the Run Test button.

   

3. Confirm that the playbook has executed without failure and performed as intended.

   

READER NOTE

Users may navigate to the investigation playbook specified within the Escalate Event to Incident task by clicking on the icon on the task.

Task 8: Submitting the Playbook

Once the playbook is complete, submit the playbook to make it available for use on ingested data.

1. Click on the Submit button.

   

2. Clicking on the popup Submit button to render the playbook .

   

Task 9: Using the Playbook on Ingested Data

To use the preprocessing playbook on ingested Office 365 data, schedule a data ingestion job.

1. Navigate to Configuration > Data Ingestion.

   

2. Click on the button and then the Schedule button.

   

3. Schedule a data ingestion job using Office 365.

   

   1. Search for and select the Office 365 integration.

   2. Choose an existing connection or add a new one.

   3. Click on the Additional Settings expandable section.

   4. Select the newly created preprocessing playbook.

   5. Enter values for the command’s input parameters as necessary.

   6. Click on the Save & Run button.

RESULT

Ingested data is processed by the preprocessing playbook, creating events as needed and automating their escalation to incidents or dismissal. This can be verified in the Investigation Dashboard under Events > All Events.

These events have been automatically dismissed because the sender's email address, associated with the emails that triggered the events in D3, contains a whitelisted domain.