Splunk_Identifier_Activity_Analysis.yml

name: Splunk Identifier Activity Analysis
id: 5299b9dc-e8c4-46ba-d942-92ace0ff816d
version: 1
date: '2023-03-31'
author: Lou Stella, Splunk
type: Investigation
description: "Accepts a file_hash, domain, IP address, or URL, and asks Splunk for a list of devices that have interacted with each. It then produces a normalized output and summary table."
playbook: Splunk_Identifier_Activity_Analysis
how_to_implement: This input playbook requires the Splunk connector to be configured. It is designed to work in conjunction with the Dynamic Identifier Activity Analysis playbook or other playbooks in the same style. 
references: []
app_list: 
  - Splunk
tags:
  platform_tags:
    - identifier_activity 
    - domain
    - file_hash
    - url
    - ip_address
  playbook_type: Input
  vpe_type: Modern
  playbook_fields: []
  product:
  - Splunk SOAR
  use_cases:
  - Enrichment
  defend_technique_id: D3-IAA