How to Phantom Playbook

[cochma]

Hi, there

I am sorry for the basic questions.
Please tell me about the following.

1. What is the definition of Playbook that detects alerts by email and registers as an incident?
2. What is the definition of a Playbook that appends a URL to Squid's BlackList on another system?

Thank you.

[rsantoso_splunk]

Hi Cochma,

Regarding the question, I assume you are looking for the available Phantom community playbook with the described capability.

1) You can search within the community playbook with the keyword “email”. Then, you will find the playbook with the title “email_notification_for_malware”. This will have the description of the playbook and find out if this is what you are looking for.

Phantom GUI > Playbooks > Search Text > Enter “email”.

Here is the description of the “email_notification_for_malware” playbook:
"This playbook tries to determine if a file is malware and whether or not the file is present on any managed machines. VirusTotal "file reputation" and PAN WildFire "detonate file" are used to determine if a file is malware, and CarbonBlack Response "hunt file" is used to search managed machines for the file. The results of these investigations are summarized in an email to the incident response team.”

2) I couldn’t find the playbook with the described functionality within the community playbook . This is maybe something you want to create with new playbook.

The Playbook zscaler_hunt_and_block_url is not exactly implemented the same, however you can use it as a sample to build your playbook with the described functionality.

You can find the information of creating the Playbook with Visual Playbook Editor (VPE) in the following url:
https://my.phantom.us/4.2/docs/vpe/playbooks