risk_notable_review_indicators.yml

name: Risk Notable Review Indicators
id: 080edc96-ff2b-48b0-9f6f-73da3783fd63
version: 1
date: "2021-10-22"
author: Kelby Shelton, Splunk
type: Response
description: This playbook was designed to be called by a user to process indicators that are marked as suspicious within the SOAR platform. Analysts will review indicators in a prompt and mark them as blocked or safe.
playbook: risk_notable_review_indicators
how_to_implement: For detailed implementation see https://docs.splunk.com/Documentation/ESSOC/latest/user/Useplaybookpack
references:
- https://docs.splunk.com/Documentation/ESSOC/latest/user/Useplaybookpack#Indicator_tagging_system
app_list: []
tags:
  labels:
  - risk_notable
  platform_tags:
  - Risk Notable
  playbook_type: Automation
  vpe_type: Modern
  product:
  - Splunk SOAR