Splunk SOAR (f.k.a. Phantom)

How to Phantom Playbook

cochma
New Member

Hi, there

I am sorry for the basic questions.
Please tell me about the following.

  1. What is the definition of Playbook that detects alerts by email and registers as an incident?
  2. What is the definition of a Playbook that appends a URL to Squid's BlackList on another system?

Thank you.

Labels (1)
Tags (1)
0 Karma

rsantoso_splunk
Splunk Employee
Splunk Employee

Hi Cochma,

Regarding the question, I assume you are looking for the available Phantom community playbook with the described capability.

1) You can search within the community playbook with the keyword “email”. Then, you will find the playbook with the title “email_notification_for_malware”. This will have the description of the playbook and find out if this is what you are looking for.

Phantom GUI > Playbooks > Search Text > Enter “email”.

Here is the description of the “email_notification_for_malware” playbook:
"This playbook tries to determine if a file is malware and whether or not the file is present on any managed machines. VirusTotal "file reputation" and PAN WildFire "detonate file" are used to determine if a file is malware, and CarbonBlack Response "hunt file" is used to search managed machines for the file. The results of these investigations are summarized in an email to the incident response team.”

2) I couldn’t find the playbook with the described functionality within the community playbook . This is maybe something you want to create with new playbook.

The Playbook zscaler_hunt_and_block_url is not exactly implemented the same, however you can use it as a sample to build your playbook with the described functionality.

You can find the information of creating the Playbook with Visual Playbook Editor (VPE) in the following url:
https://my.phantom.us/4.2/docs/vpe/playbooks

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...