Playbook: Hunting

Description

The hunting Playbook queries a number of internal security technologies in order to determine if any of the artifacts present in your data source have been observed in your environment.

Type: Investigation Date: 2021-01-21 Author: Philip Royer, Splunk ID: fb3edc76-ff2b-48b0-5f6f-63da6351ad63

Apps

Splunk, Reversing Labs, Carbon Black Response, Threat Grid, Falcon Host API

How To Implement

Be sure to update asset naming to reflect the asset names configured in your environment.

Explore Playbook

explore

Required fields

  • fileHash

  • vault_id

Reference

source | version: 1