Stage Tasks

EXAMPLE 1

A phishing playbook may include stages such as:

• Email Analysis

• IP Enrichment

• URL Enrichment

• Attachment Enrichment

• Domain Enrichment

• Threat Summary

• User Notification

EXAMPLE 2

An insider threat investigation playbook may include stages such as:

• Anomaly Detection

• User Behavior Analysis

• Data Exfiltration Analysis

• Identity and Access Review

• Threat Correlation and Risk Assessment

• Incident Escalation and Stakeholder Notification

EXAMPLE 3

A cloud security breach response playbook may include stages such as:

• Unauthorized Activity Detection

• Asset Inventory and Exposure Assessment

• Threat Intelligence Correlation

• Containment and Access Restriction

• Data Exfiltration and Integrity Check

• Forensic Investigation and Log Analysis

• Recovery and System Restoration

• System Reinforcement

OBJECTIVE
Tracking the execution of a live multi-stage playbook in the incident workspace as stages progress and complete.

1. Build the following playbook.

   

READER NOTE

• Ensure all stage tasks are configured to auto-run.

• Configure the first data formatter task as non-auto-run.

• Configure the second data formatter task to auto-run.

2. Submit this playbook.

   

3. Publish this playbook to the relevant sites.

   

4. Create a new incident.

   

5. Configure the incident to run the submitted playbook, then click on the + Add button.

   

6. Navigate to the incident workspace of the manually created incident.

7. Observe the current investigation stage of this incident, then open the running playbook.

   

   Incident Workspace UI in Earlier D3 vSOC Versions

   

8. Click on the pending interaction task.

   

9. Provide an input, then click on the button.

   

10. Observe the change in investigation stage, then return to the running playbook.

    

    Incident Workspace UI in Earlier D3 vSOC Versions

    

11. Click on the pending data formatter task.

    

12. Click on the button.

    

13. Verify that all tasks have run to completion.

    

14. Observe the change in investigation stage.

    

    Incident Workspace UI in Earlier D3 vSOC Versions

    

Investigation Dashboard

Incident Workspace

OBJECTIVE

Understanding the impact of assigning an assignee by role.

1. Ensure a Demo Investigator role is created and configured to be able to edit accessible records.

   

2. Ensure that at least one user is assigned the Demo Investigator role.

   

3. Create the following investigation playbook, assigning the Stage 1 (Assigned) task to users with the Demo Investigator role.

   

   

READER NOTE

• Configure all tasks in the top execution stream to non-auto-run.

• Configure all tasks in the bottom execution stream to auto-run.

4. Submit this playbook.

   

5. Publish this playbook to the relevant sites.

   

6. Click on the button, configure the incident to run the submitted playbook, then click on the button.

   

7. Navigate to the Playbooks sub-module within the incident workspace.

   

8. Click on the pending Stage 1 (Assigned) task.

   

   • View Based on Assignment:

     • Assignees

       

     • Non-Assignees (with the same role)

       

Assignees can now track workflow progress, monitor execution, provide required inputs, document outcomes, and take actions per SOC or business requirements.

SCENARIO An analyst is building a playbook to check IP reputation, using stage tasks to organize workflow and ensure an email is sent only after the preceding stage task executes.

Here is how they built the playbook:

1. Add a stage task to the On Playbook Start trigger to mark the beginning of the IP analysis.

   

2. Name the task Begin IP Analysis, select the Auto Run checkbox, then click the button to save.

   

3. Add a command task that can check the reputation of IP addresses (e.g., the Check IP Reputation command from VirusTotal v3) to the stage task, and configure it.

   

4. Add a stage task to the previous task to control the workflow progression.

   

5. Name the task Triage, assign it to a user, and set a due time.

   

6. (Optional) Add an instruction for the assignee, then click the button to save the task.

   

7. Add the Send Email utility command task to the previous task, and configure it.

   

8. Submit this playbook.

   

9. Publish this playbook to the relevant sites.

   

10. Click on the button, configure the incident to run the submitted playbook, then click on the button.

    

11. Ask the assigned investigator to click the assigned stage task in the Pending Tasks Assigned to Me view on their investigation dashboard.

    

12. Ask the investigator to click the Run button after performing the task stated in the Instruction section to move along the playbook execution.

    

RESULT

Executing the Triage task enabled the subsequent Send Email task to run. The recipient will receive the email sent by the command task, as shown in the image below.