risk_notable_protect_assets_and_users.yml

name: Risk Notable Protect Assets and Users
id: 070edc96-ff2b-48b0-9f6f-93da3783fd63
version: 1
date: "2021-10-22"
author: Kelby Shelton, Splunk
type: Response
description: This playbook attempts to find assets and users from the notable event and match those with assets and identities from Splunk ES. If a match was found and the user has playbooks available to contain entities, the analyst decides which entities to disable or quarantine.
playbook: risk_notable_protect_assets_and_users
how_to_implement: For detailed implementation see https://docs.splunk.com/Documentation/ESSOC/latest/user/Useplaybookpack
references:
- https://docs.splunk.com/Documentation/ESSOC/latest/user/Useplaybookpack#Call_child_playbooks_with_the_dynamic_playbook_system
app_list: []
tags:
  labels:
  - risk_notable
  playbook_outputs:
  - note_title
  - note_content
  playbook_type: Automation
  vpe_type: Modern
  platform_tags:
  - Risk Notable
  product:
  - Splunk SOAR