Skip to main content

TIM - Process Office365 indicators

This Playbook is part of the Office 365 Feed Pack.#

Supported versions

Supported Cortex XSOAR versions: 5.5.0 and later.

This playbook handles the tagging of Office365 indicators. Specify the tag to apply to these indicators in the playbook inputs. An example tag will be approved_white. If no inputs are specified, the indicators will be tagged for manual review. The user can specify whether a manual review incident is required.


This playbook uses the following sub-playbooks, integrations, and scripts.


This playbook does not use any sub-playbooks.


This playbook does not use any integrations.


This playbook does not use any scripts.


  • appendIndicatorField
  • createNewIncident

Playbook Inputs#

NameDescriptionDefault ValueRequired
Office365FeedIndicatorTagNameUse this input to define which tag to apply to Office 365 Feed indicators. An example tag can be approved_white. If no tags are specified in the input, the tag whitelist_review will be used.Optional
Indicator QueryIndicators matching the indicator query will be used as playbook inputsourceBrands:"Office 365 Feed"Optional
OpenIncidentToReviewIndicatorsManuallyThis input determines if processed indicators that have the whitelist_review tag are reviewed in a new incident. To create an incident, enter any value other than 'No'.NoOptional

Playbook Outputs#

There are no outputs for this playbook.

Playbook Image#

Playbook Image