Generic Playbooks

Generic Playbooks

Playbook Name	Description
Analyze Body and Headers	It takes the email's body and header to extract metadata from the body and URLs from the header.
Azure Block All International Access Policy Changes	Checks for changes in the list of users in the access policy. It investigates all the users excluded from the access policy and creates a ticket in Freshdesk ticketing system based on the change.
Azure Conditional Access Policy Summary	Checks for the change in the Azure conditional access policy and creates a case item based on the detected change. It can also use API to create a ticket in the ticketing system based on the policy change
Duo Fraud Compare	Compares the geo location of access device, authentication device, and previous logged-in device.
Duo Fraud Investigation	Investigates a suspicious login attempt and creates a ticket in Freshdesk ticketing system for a suspicious login.
Duo Fraud Main	Uses the sub-playbook Duo Fraud Investigation to investigate suspicious attempts to log in through Duo.
Get SPAM Score	Takes specific information from the email's header, analyzes it, and generates a spam score. It returns the score back to the parent playbook.
IP Reputation Status - Multi Vendor	Analyzes the IP Address using Threat Intelligence Analysis to give a verdict on the IP Address and set its risk score
Malwarebytes Run Scan And Quarantine	Uses Malwarebytes API for threat investigation. It scans for potential malware in the endpoint and isolates it to prevent the malware from spreading in the system.
Microsoft Defender Investigation	Uses Microsoft Defender for Endpoint API to investigate a threat and returns the investigation details.
O365 AD User Details	Uses Azure Active Directory API to extract user details.
0365_Auth_Fetch_ID	Authenticates to Microsoft's API, receives a token, and uses it to fetch the mail-related information for mail ID.
PaloAlto Potential C2 Connection	Investigates an incident triggered by an IP address that is suspected to be a C2 server.
PaloAlto Potential C2 Investigation	Investigates an incident triggered by an IP address that is suspected to be a C2 server.
Set URL Threat Score	Analyzes the URL using ThreatIntel and VirusTotal Analysis to give a verdict to the URL and set its severity.
UEBA Add Activity to Whitelist	Use to decide whether to add the user and the activity to a permanent or temporary whitelist, or not.
UEBA Suspicious Activity Detected	Detects and investigates unusual behavior and measures the likelihood of the suspicious activity being a threat. It leverages the UEBA Triage sub-playbook to aggregate and assess data including incident ID, alert, threat type and category. It then creates response tasks and compiles the result into a report sent to your security team.
User Reported Phishing	Investigates reported phishing emails by leveraging a User-Reported Phishing Investigation sub-playbook. When a user reports an email as suspected phishing, the playbook creates response tasks and compiles the results into a report sent to your security team.
User Reported Phishing investigation	Analyzes the probability of a suspected phishing attempt from a sender domain. If the email is likely phishing, this playbook investigates it. If not, the playbook stops.
UEBA Suspicious Activity Detected	Detects and investigates unusual behavior and measures the likelihood of the suspicious activity being a threat. It leverages the UEBA Triage sub-playbook to aggregate and assess data including incident ID, alert, threat type and category. It then creates response tasks and compiles the result into a report sent to your security team.