SafeBreach - Create Incidents per Insight and Associate Indicators

This is a sub-playbook that creates incidents per SafeBreach insight, enriched with all the related indicators and additional SafeBreach insight contextual information. Used in main SafeBreach playbooks, such as "SafeBreach - Process Behavioral Insights Feed" and "SafeBreach - Process Non-Behavioral Insights Feed".

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

  • SafeBreach_v2

Scripts

  • Set
  • SearchIncidentsV2

Commands

  • associateIndicatorToIncident
  • safebreach-get-insights
  • createNewIncident

Playbook Inputs


NameDescriptionDefault ValueRequired
Indicator QueryIndicators matching the indicator query will be used as playbook inputsafebreachisbehavioral:TOptional
insightIdsList of Insight ids to create incidents for.Required
indicatorsList of indicators that to be assigned to created incidentsRequired

Playbook Outputs


PathDescriptionType
incidentIncidents created from SafeBreach InsightsArray

Playbook Image


SafeBreach - Create Incidents per Insight and Associate Indicators