Splunk SOAR (f.k.a. Phantom)

How to Phantom Playbook

New Member

Hi, there

I am sorry for the basic questions.
Please tell me about the following.

  1. What is the definition of Playbook that detects alerts by email and registers as an incident?
  2. What is the definition of a Playbook that appends a URL to Squid's BlackList on another system?

Thank you.

Labels (1)
Tags (1)
0 Karma

Splunk Employee
Splunk Employee

Hi Cochma,

Regarding the question, I assume you are looking for the available Phantom community playbook with the described capability.

1) You can search within the community playbook with the keyword “email”. Then, you will find the playbook with the title “email_notification_for_malware”. This will have the description of the playbook and find out if this is what you are looking for.

Phantom GUI > Playbooks > Search Text > Enter “email”.

Here is the description of the “email_notification_for_malware” playbook:
"This playbook tries to determine if a file is malware and whether or not the file is present on any managed machines. VirusTotal "file reputation" and PAN WildFire "detonate file" are used to determine if a file is malware, and CarbonBlack Response "hunt file" is used to search managed machines for the file. The results of these investigations are summarized in an email to the incident response team.”

2) I couldn’t find the playbook with the described functionality within the community playbook . This is maybe something you want to create with new playbook.

The Playbook zscaler_hunt_and_block_url is not exactly implemented the same, however you can use it as a sample to build your playbook with the described functionality.

You can find the information of creating the Playbook with Visual Playbook Editor (VPE) in the following url:

0 Karma
Get Updates on the Splunk Community!

Don't wait! Accept the Mission Possible: Splunk Adoption Challenge Now and Win ...

Attention everyone! We have exciting news to share! We are recruiting new members for the Mission Possible: ...

Unify Your SecOps with Splunk Mission Control

In today’s post, I'm excited to share some recent Splunk Mission Control innovations. With Splunk Mission ...

Data Preparation Made Easy: SPL2 for Edge Processor

By now, you may have heard the exciting news that Edge Processor, the easy-to-use Splunk data preparation tool ...