Stage Tasks

Example 1

A phishing playbook may include stages such as:

• Email Analysis

• IP Enrichment

• URL Enrichment

• Attachment Enrichment

• Domain Enrichment

• Threat Summary

• User Notification

Example 2

An insider threat investigation playbook may include stages such as:

• Anomaly Detection

• User Behavior Analysis

• Data Exfiltration Analysis

• Identity and Access Review

• Threat Correlation and Risk Assessment

• Incident Escalation and Stakeholder Notification

Example 3

A cloud security breach response playbook may include stages such as:

• Unauthorized Activity Detection

• Asset Inventory and Exposure Assessment

• Threat Intelligence Correlation

• Containment and Access Restriction

• Data Exfiltration and Integrity Check

• Forensic Investigation and Log Analysis

• Recovery and System Restoration

• System Reinforcement

Objective
Tracking the execution of a live multi-stage playbook in the incident workspace as stages progress and complete.

---

1. Build the following playbook.

   

2. Select Go Live.

   

3. In the Manage Site Access and Go Live window, move the relevant sites to Sites with Access, then select Confirm & Go Live.

   

4. Select New Incident in the header to create an incident.

   

5. In the New Incident window, choose the live playbook in Playbook, then select + Add.

   

6. Navigate to the incident workspace of the manually created incident.

7. Observe the current investigation stage of this incident, then open the running playbook.

   

   Incident Workspace UI in Earlier D3 Versions

   

8. Click on the pending interaction task.

   

9. Provide an input, then click on the 10.2.0.134_BetaPreview_VSOC_LifeServer.aspx_div=dashboard&Open=Other&t2=08b859c192aa477b646ed6674d44ec4fc61cc62429bafabfde553a46b91faa0a (13) 1-20250305-230558.png button.

   

10. Observe the change in investigation stage, then return to the running playbook.

    

    Incident Workspace UI in Earlier D3 vSOC Versions

    

11. Click on the pending data formatter task.

    

12. Click on the 10.2.0.134_BetaPreview_VSOC_LifeServer.aspx_div=dashboard&Open=Other&t2=08b859c192aa477b646ed6674d44ec4fc61cc62429bafabfde553a46b91faa0a (13) 1-20250305-230558.pngbutton.

    

13. Verify that all tasks have run to completion.

    

14. Observe the change in investigation stage.

    

    Incident Workspace UI in Earlier D3 vSOC Versions

    

Investigation Dashboard

Incident Workspace

objective

Understanding the impact of assigning an assignee by role.

---

1. Ensure a Demo Investigator role is created and configured to be able to edit accessible records.

   

2. Ensure that at least one user is assigned the Demo Investigator role.

   

3. Create the following investigation playbook, assigning the Stage 1 (Assigned) task to users with the Demo Investigator role.

   
   

4. Select Go Live.

   

5. In the Manage Site Access and Go Live window, move the relevant sites to Sites with Access, then select Confirm & Go Live.

   

6. Select New Incident in the header, choose the live playbook in Playbook, then select + Add.

   

7. Navigate to the Playbooks sub-module within the incident workspace.

   

8. Click on the pending Stage 1 (Assigned) task.

   

   • View Based on Assignment:

     • Assignees

       

     • Non-Assignees (with the same role)

       

Assignees can now track workflow progress, monitor execution, provide required inputs, document outcomes, and take actions per SOC or business requirements.

scenario An analyst is building a playbook to check IP reputation, using stage tasks to organize workflow and ensure an email is sent only after the preceding stage task executes.

Here is how they built the playbook:

1. Add a stage task to the On Playbook Start trigger to mark the beginning of the IP analysis.

   

2. Name the task Begin IP Analysis, select Auto Run, then select the check mark to save.

   

3. Add a command task that can check the reputation of IP addresses (e.g., the Check IP Reputation command from VirusTotal v3) to the stage task, and configure it.

   

4. Add a stage task to the previous task to control the workflow progression.

   

5. Name the task Triage, choose who it is assigned to in Assigned To, and set the Due Time (Whole Numbers Only).

   

6. (Optional) Add an instruction for the assignee in Instruction, then select the check mark to save the task.

7. Add the Send Email utility command task to the previous task, and configure it.

   

8. Select Go Live.

   

9. In the Manage Site Access and Go Live window, move the relevant sites to Sites with Access, then select Confirm & Go Live.

   

10. Select New Incident in the header, choose the live playbook in Playbook, then select + Add.

    

11. Ask the assigned investigator to click the assigned stage task on their Pending Tasks page (sidebar Pending Tasks; the view list at the top starts on All Pending Tasks).

    

12. Ask the investigator to click the Run button after performing the task stated in the Instruction section to move along the playbook execution.