Risk Notable Block Indicators
Description
This playbook handles locating indicators marked for blocking and determining if any blocking playbooks exist. If there is a match to the appropriate tags in the playbook, a filter block routes the name of the playbook to launch to a code block.
- Type: Response
- Product: Splunk SOAR
- Apps:
- Last Updated: 2021-10-22
- Author: Kelby Shelton, Splunk
- ID: 000edc96-ff2b-48b0-9f6f-83da3783fd63
- Use-cases:
Associated Detections
How To Implement
For detailed implementation see https://docs.splunk.com/Documentation/ESSOC/latest/user/Useplaybookpack
Explore Playbook
Required field
Reference
- https://docs.splunk.com/Documentation/ESSOC/latest/user/Useplaybookpack#Call_child_playbooks_with_the_dynamic_playbook_system
- https://docs.splunk.com/Documentation/ESSOC/latest/user/Useplaybookpack#Indicator_tagging_system
source | version: 1