NIST-800-61ComputerIncidentHandlingGuide_v3.json

{"id": "9f9a07d2-5ddd-4da5-85b7-1fd091a7d281", "create_time": 1774298307.1793516, "update_time": 1774369237.4506512, "name": "NIST-800-61%20Computer%20Incident%20Handling%20Guide", "description": "", "template_status": "published", "creator": "splunker", "updated_by": "splunker", "is_default": false, "version": 3, "phases": [{"id": "97bc8622-69ca-48a1-bf2b-e4067281f71a", "create_time": 1774368230.649333, "update_time": 1774369237.4164562, "name": "Detection", "order": 1, "tasks": [{"id": "9126eb2f-d5e2-48e7-a9f5-0c851f2ecc57", "create_time": 1764758755.7593036, "update_time": 1774369237.4155514, "name": "Determine if an incident has occurred", "order": 1, "tag": "dd8a2e5b-9131-4321-ad10-0cef889e30f1", "description": "Suggested%20Dashboards%0A1.%20%5BRisk%20Analysis%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/risk_analysis)%0A2.%20%5BIdentity%20Investigator%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/identity_investigator)%0A", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0}, {"id": "1d9a756c-20dc-4e2e-94e1-87f4eb164447", "create_time": 1764758755.7594106, "update_time": 1774369237.415731, "name": "Analyze precursors and indicators", "order": 2, "tag": "cd6639cc-79b1-4f66-b03a-0b29118e9439", "description": "Review%20Threat%20Intelligence%20on%20Observables%20in%20the%20Intelligence%20tab%0A%0ASuggested%20Integration%20(%20if%20not%20already%20configured%20navigate%20%5BHERE%5D(/app/SplunkEnterpriseSecuritySuite/ess_configuration/#/soar/soar_apps/apps)%20to%20locate%20and%20configure)%0A1.%20Splunk%20Attack%20Analyzer%0A2.%20Cisco%20Talos%20Intelligence%0A3.%20VirusTotal%20v3%0A4.%20PhishTank%20", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [{"id": "5f00c445-402a-4e83-8287-36d916f2a91f", "create_time": 1774368230.648273, "update_time": 1774369237.415865, "last_job_id": 0, "name": "detonate file - Splunk Attack Analyzer Connector for Splunk SOAR", "action": "8939", "description": "Submit File for Scanning", "type": "detonate file", "app_id": 283, "asset": 23, "parameters": [{"file": "", "ph_0": "", "profile": "", "user_agent": "", "internet_region": "", "archive_password": "", "custom_user_agent": ""}]}, {"id": "63ff87f5-424e-433d-85f1-d8be073055ae", "create_time": 1774368230.6483395, "update_time": 1774369237.4159017, "last_job_id": 0, "name": "detonate url - Splunk Attack Analyzer Connector for Splunk SOAR", "action": "8940", "description": "Submit New URL for Scanning", "type": "detonate url", "app_id": 283, "asset": 23, "parameters": [{"url": "", "ph_0": "", "profile": "", "user_agent": "", "internet_region": "", "archive_password": "", "custom_user_agent": ""}]}, {"id": "6e51d2ca-3d9a-453f-942b-99c2741a2fd8", "create_time": 1774368230.6484013, "update_time": 1774369237.4159362, "last_job_id": 0, "name": "get job summary - Splunk Attack Analyzer Connector for Splunk SOAR", "action": "8937", "description": "Get a job summary for a submitted job", "type": "get job summary", "app_id": 283, "asset": 23, "parameters": [{"job_id": "", "timeout": ""}]}, {"id": "9ac8c45c-8de3-4e73-8d8f-8dfca7473b33", "create_time": 1774368230.6484618, "update_time": 1774369237.415971, "last_job_id": 0, "name": "domain reputation - Cisco Talos Intelligence", "action": "7850", "description": "Query domain info", "type": "domain reputation", "app_id": 61, "asset": 11, "parameters": [{"domain": ""}]}, {"id": "2ba9855a-5568-4668-9cb3-e298684f4148", "create_time": 1774368230.6485221, "update_time": 1774369237.4160051, "last_job_id": 0, "name": "ip reputation - Cisco Talos Intelligence", "action": "7849", "description": "Query IP info", "type": "ip reputation", "app_id": 61, "asset": 11, "parameters": [{"ip": ""}]}, {"id": "6eee000a-d827-4325-86ee-8a0239196fe6", "create_time": 1774368230.6485846, "update_time": 1774369237.4160404, "last_job_id": 0, "name": "url reputation - Cisco Talos Intelligence", "action": "7851", "description": "Query URL info", "type": "url reputation", "app_id": 61, "asset": 11, "parameters": [{"url": ""}]}, {"id": "1abbe2a9-1111-4ccb-80b1-1a6f1f1629e2", "create_time": 1774368230.6486483, "update_time": 1774369237.4160743, "last_job_id": 0, "name": "domain reputation - VirusTotal v3", "action": "8999", "description": "Queries VirusTotal for domain info", "type": "domain reputation", "app_id": 323, "asset": 28, "parameters": [{"domain": ""}]}, {"id": "775774d9-fb4a-4cdd-be3c-13d033f87f09", "create_time": 1774368230.6487136, "update_time": 1774369237.416108, "last_job_id": 0, "name": "file reputation - VirusTotal v3", "action": "9000", "description": "Queries VirusTotal for file reputation info", "type": "file reputation", "app_id": 323, "asset": 28, "parameters": [{"hash": ""}]}, {"id": "37662f39-84f6-4d91-95c9-4ae319d17a27", "create_time": 1774368230.648798, "update_time": 1774369237.4161413, "last_job_id": 0, "name": "ip reputation - VirusTotal v3", "action": "9002", "description": "Queries VirusTotal for IP info", "type": "ip reputation", "app_id": 323, "asset": 28, "parameters": [{"ip": ""}]}, {"id": "aaab0628-521c-4332-8a33-2b85967b0ea2", "create_time": 1774368230.6488643, "update_time": 1774369237.4161754, "last_job_id": 0, "name": "url reputation - VirusTotal v3", "action": "9003", "description": "Queries VirusTotal for URL info (run this action after running detonate url)", "type": "url reputation", "app_id": 323, "asset": 28, "parameters": [{"url": ""}]}], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0}, {"id": "974fdd62-7d20-40f3-912d-60d708146ac7", "create_time": 1764758755.7595055, "update_time": 1774369237.4162376, "name": "Look for correlating information", "order": 3, "tag": "64b3aaa7-416e-4ec2-8cc1-b54b1e0758db", "description": "Suggested%20Integrations%0A1.%20%5BAnalyst%20Queue%5D(/app/SplunkEnterpriseSecuritySuite/incident_review)%0A2.%20%5BRisk%20Analysis%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/risk_analysis)%0A", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0}, {"id": "c8d1664e-4d06-4470-8b99-124c615500ca", "create_time": 1764758755.759612, "update_time": 1774369237.416325, "name": "Perform research", "order": 4, "tag": "c534e89d-327c-4deb-bc29-51fb49f65af6", "description": "Use%20search%20engines,%20knowledge%20bases,%20etc..%0A%0ASuggested%20Dashboards%0A1.%20%20%5BRisk%20Analysis%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/risk_analysis)%0A2.%20Review%20Threat%20Intelligence%20on%20Observables%20in%20the%20Intelligence%20tab", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0}, {"id": "247f8ee3-e7db-437d-9a16-07e2d19673c0", "create_time": 1764758755.7597096, "update_time": 1774369237.4164124, "name": "Confirmed incident", "order": 5, "tag": "415e3412-85ed-4af6-bf6e-09e6e13542b3", "description": "For a confirmed incident, document the investigation and gather evidence. Attach all relevant information from detection steps to the notable.", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0}]}, {"id": "ef47436d-de45-4aab-ba6b-736137c41076", "create_time": 1774368230.6502717, "update_time": 1774369237.4181538, "name": "Analysis and Containment", "order": 2, "tasks": [{"id": "27f4ca0d-ef69-4211-9401-34d3817e879f", "create_time": 1764758755.759852, "update_time": 1774369237.4165218, "name": "Determine functional impact", "order": 1, "tag": "58850454-d4af-4cc4-a5dd-fded4be0ff4d", "description": "Suggested categories: None, Low, Medium, High", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0}, {"id": "b298ad0a-b53c-4e4d-9e27-0307d2b49d9f", "create_time": 1764758755.759945, "update_time": 1774369237.4165962, "name": "Determine information impact", "order": 2, "tag": "1150410e-72c0-4259-a499-d632727e083b", "description": "Suggested categories: None, Privacy breach, Proprietary breach, Integrity loss", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0}, {"id": "650388ac-fa31-48c9-8031-fab7fbc1cce8", "create_time": 1764758755.760036, "update_time": 1774369237.4166708, "name": "Determine recoverability effort", "order": 3, "tag": "d6e187c9-188c-49de-ac41-5092d7ce6435", "description": "Suggested categories: Regular, Supplemented, Extended, Not Recoverable", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0}, {"id": "ae810a6c-7314-49f2-84cb-b40557c17734", "create_time": 1764758755.7601304, "update_time": 1774369237.4167435, "name": "Prioritize incident", "order": 4, "tag": "082dfce7-169c-4bd2-aa73-7d39f5e26be8", "description": "Prioritize handling the incident based on the relevant factors", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0}, {"id": "3db4552a-5c3b-46e2-8792-88f27397d5ef", "create_time": 1764758755.760304, "update_time": 1774369237.4168317, "name": "Report incident", "order": 5, "tag": "716c8ff4-f8f9-406a-aa10-871b499d0892", "description": "Report%20the%20incident%20to%20the%20the%20appropriate%20internal%20personnel%20and%20external%20organizations%0A%0ASuggested%20Integration%20(%20if%20not%20already%20configured%20navigate%20%5BHERE%5D(/app/SplunkEnterpriseSecuritySuite/ess_configuration/#/soar/soar_apps/apps)%20to%20locate%20and%20configure)%0A1.%20SMTP%0A2.%20%20MS%20Graph%20for%20Office%20365%0A3.%20%20G%20Suite%20for%20GMail%0A4.%20Cisco%20Webex%0A5.%20Slack", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [{"id": "15f24b11-fca4-443c-ac89-5e72eb96024e", "create_time": 1774368549.0781374, "update_time": 1774369237.4169018, "last_job_id": 0, "name": "send email - SMTP", "action": "9244", "description": "Sends an email", "type": "send email", "app_id": 260, "asset": 36, "parameters": [{"cc": "", "to": "", "bcc": "", "body": "", "from": "", "headers": "", "subject": "", "attachments": ""}]}, {"id": "6cf45616-dc96-4df9-b95a-aadd9c582950", "create_time": 1774368549.0782, "update_time": 1774369237.4169366, "last_job_id": 0, "name": "send email - MS Graph for Office 365", "action": "8880", "description": "Sends an email with optional text rendering. Attachments are allowed a Content-ID tag for reference within the html", "type": "send email", "app_id": 175, "asset": 15, "parameters": [{"cc": "", "to": "", "bcc": "", "body": "", "from": "", "headers": "", "subject": "", "attachments": ""}]}, {"id": "c2e05283-606e-4c73-974e-0993b105138f", "create_time": 1774368549.0782459, "update_time": 1774369237.416971, "last_job_id": 0, "name": "send email - G Suite for GMail", "action": "9227", "description": "Send emails", "type": "send email", "app_id": 123, "asset": 34, "parameters": [{"cc": "", "to": "", "bcc": "", "body": "", "from": "", "headers": "", "subject": "", "reply_to": "", "alias_name": "", "alias_email": "", "attachments": ""}]}, {"id": "fe1e41fa-c4bc-4ed0-b258-1a300ca7758d", "create_time": 1774368549.078287, "update_time": 1774369237.417005, "last_job_id": 0, "name": "send message - Cisco Webex", "action": "9205", "description": "Send message to user or room", "type": "send message", "app_id": 64, "asset": 32, "parameters": [{"message": "", "endpoint_id": "", "is_markdown": false, "destination_type": ""}]}, {"id": "de86f6ec-65cd-4079-b20d-8c995b7c894f", "create_time": 1774368549.078327, "update_time": 1774369237.4170387, "last_job_id": 0, "name": "send message - Slack", "action": "8927", "description": "Send a message to Slack", "type": "send message", "app_id": 277, "asset": 22, "parameters": [{"blocks": "", "message": "", "link_names": false, "destination": "", "reply_broadcast": false, "parent_message_ts": ""}]}, {"id": "921801f8-0712-48c7-af8a-2ef15de09552", "create_time": 1774368549.0783672, "update_time": 1774369237.4170723, "last_job_id": 0, "name": "send direct message - Microsoft Teams", "action": "9234", "description": "Send a direct message to a user", "type": "send direct message", "app_id": 198, "asset": 35, "parameters": [{"message": "", "user_id": ""}]}], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0}, {"id": "2ab31b96-9544-4949-8e63-04a674e6bdb6", "create_time": 1764758755.7604578, "update_time": 1774369237.4171317, "name": "Contain incident", "order": 6, "tag": "d05de9e0-1c72-4835-874a-83f6127ef09a", "description": "Suggested%20Integration%20(%20if%20not%20already%20configured%20navigate%20%5BHERE%5D(/app/SplunkEnterpriseSecuritySuite/ess_configuration/#/soar/soar_apps/apps)%20to%20locate%20and%20configure)%0A1.%20Cisco%20Firepower%0A2.%20Cisco%20Secure%20Firewall%0A3.%20Palo%20Alto%0A4.%20Zscaler%0A5.%20Crowdstrike%0A6.%20Microsoft%20Defender%20for%20Endpoint%0A8.%20VMware%20Carbon%20Black%20Cloud%20for%20Splunk%20SOARSuggested%20Integrations%0A9.%20MS%20Graph%20For%20Active%20Directory%0A10.%20AD%20LDAP%0A11.%20Okta%0A12.%20AWS%20IAM%0A13.%20Azure%20AD%20Graph", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [{"id": "1851b7bb-5378-44e6-a5db-82ae5ea5e821", "create_time": 1774369050.4120188, "update_time": 1774369237.417205, "last_job_id": 0, "name": "block ip - Cisco Firepower", "action": "9266", "description": "Blocks an IP network", "type": "block ip", "app_id": 56, "asset": 40, "parameters": [{"ip": ""}]}, {"id": "3c02c2f9-09c8-4b4f-b4dd-31f3964fa3ce", "create_time": 1774369050.4120603, "update_time": 1774369237.4172509, "last_job_id": 0, "name": "delete network object - Cisco Secure Firewall", "action": "9272", "description": "Deletes a network object in FMC", "type": "delete network object", "app_id": 59, "asset": 41, "parameters": [{"type": "", "object_id": "", "domain_name": ""}]}, {"id": "ab32451a-b980-4216-b76e-f4a4859cf07a", "create_time": 1774369050.4120996, "update_time": 1774369237.4172843, "last_job_id": 0, "name": "delete quarantine message - Cisco Secure Email and Web Manager", "action": "9301", "description": "Delete a message from Policy, Virus, Outbreak, or other quarantines", "type": "delete quarantine message", "app_id": 58, "asset": 46, "parameters": [{"message_id": "", "quarantine_name": ""}]}, {"id": "315a3b60-be5b-40e1-b363-56af30175fdf", "create_time": 1774369050.4121392, "update_time": 1774369237.417318, "last_job_id": 0, "name": "block application - Panorama", "action": "8649", "description": "Block an application", "type": "block application", "app_id": 220, "asset": 42, "parameters": [{"application": "", "policy_name": "", "policy_type": "", "device_group": "", "audit_comment": "", "use_partial_commit": false, "should_commit_changes": false}]}, {"id": "42bac7f1-1b6c-4c7d-9f63-0fb9a16c76f4", "create_time": 1774369050.4121783, "update_time": 1774369237.4173522, "last_job_id": 0, "name": "block ip - Panorama", "action": "8651", "description": "Block an IP", "type": "block ip", "app_id": 220, "asset": 42, "parameters": [{"ip": "", "policy_name": "", "policy_type": "", "device_group": "", "audit_comment": "", "should_add_tag": false, "is_source_address": false, "use_partial_commit": false, "should_commit_changes": false}]}, {"id": "a553b954-2f1d-428f-88d1-c52d54a786b0", "create_time": 1774369050.4122179, "update_time": 1774369237.417386, "last_job_id": 0, "name": "block url - Panorama", "action": "8647", "description": "Block an URL", "type": "block url", "app_id": 220, "asset": 42, "parameters": [{"url": "", "policy_name": "", "policy_type": "", "device_group": "", "audit_comment": "", "use_partial_commit": false, "should_commit_changes": false}]}, {"id": "ef0d7a78-b4fe-4552-9d58-ff1ad314c43e", "create_time": 1774369050.412257, "update_time": 1774369237.4174206, "last_job_id": 0, "name": "custom block policy - Panorama", "action": "8663", "description": "Block IP addresses, Address Groups, EDLs(External Dynamic List), Applications, or URL Categories in Panorama and creates a custom uni-directional (direction parameter value as from or to) or bi-directional (direction parameter value as both) security rule", "type": "custom block policy", "app_id": 220, "asset": 42, "parameters": [{"dst": "", "ph0": "", "tag": "", "where": "", "target": "", "direction": "", "rule_type": "", "description": "", "object_type": "", "policy_name": "", "policy_type": "", "device_group": "", "object_value": "", "audit_comment": "", "log_forwarding": "", "icmp_unreachable": "", "use_partial_commit": false, "should_commit_changes": false}]}, {"id": "7d3b9a89-5b45-4344-b65f-3d1597a56505", "create_time": 1774369050.4122963, "update_time": 1774369237.4174554, "last_job_id": 0, "name": "block ip - Zscaler", "action": "9074", "description": "Block an IP", "type": "block ip", "app_id": 338, "asset": 30, "parameters": [{"ip": "", "url_category": ""}]}, {"id": "53fa18b6-3449-4a4f-af11-dd0bf7ee0caa", "create_time": 1774369050.412336, "update_time": 1774369237.4174888, "last_job_id": 0, "name": "block url - Zscaler", "action": "9075", "description": "Block a URL", "type": "block url", "app_id": 338, "asset": 30, "parameters": [{"url": "", "url_category": ""}]}, {"id": "6074553c-9354-48d4-8488-71ad81498863", "create_time": 1774369050.4123755, "update_time": 1774369237.4175224, "last_job_id": 0, "name": "remove group user - Zscaler", "action": "9089", "description": "Remove user from group", "type": "remove group user", "app_id": 338, "asset": 30, "parameters": [{"user_id": "", "group_id": ""}]}, {"id": "cea9c288-1db6-4f14-9c6c-3e3fdba1c00d", "create_time": 1774369050.4124148, "update_time": 1774369237.4175558, "last_job_id": 0, "name": "delete indicator - CrowdStrike OAuth API", "action": "8800", "description": "Delete an indicator that is being watched", "type": "delete indicator", "app_id": 77, "asset": 44, "parameters": [{"ioc": "", "resource_id": ""}]}, {"id": "b0ac613b-1e9d-4803-96fc-5680e7764882", "create_time": 1774369050.4124534, "update_time": 1774369237.4175885, "last_job_id": 0, "name": "delete session - CrowdStrike OAuth API", "action": "8766", "description": "Deletes a Real Time Response session", "type": "delete session", "app_id": 77, "asset": 44, "parameters": [{"session_id": ""}]}, {"id": "3662722a-7c02-4c0b-bf6b-e2a474264427", "create_time": 1774369050.412492, "update_time": 1774369237.417621, "last_job_id": 0, "name": "quarantine device - CrowdStrike OAuth API", "action": "8761", "description": "Block the device", "type": "quarantine device", "app_id": 77, "asset": 44, "parameters": [{"hostname": "", "device_id": ""}]}, {"id": "719588aa-01da-4fe3-ad1a-0a8164028290", "create_time": 1774369050.4125314, "update_time": 1774369237.417654, "last_job_id": 0, "name": "delete indicator - Windows Defender ATP", "action": "9036", "description": "Delete an Indicator entity by ID", "type": "delete indicator", "app_id": 191, "asset": 45, "parameters": [{"indicator_id": ""}]}, {"id": "65513aa2-c011-47fa-83c8-0b4d75185d84", "create_time": 1774369050.4125717, "update_time": 1774369237.417687, "last_job_id": 0, "name": "quarantine device - Windows Defender ATP", "action": "9016", "description": "Quarantine the device", "type": "quarantine device", "app_id": 191, "asset": 45, "parameters": [{"type": "", "comment": "", "timeout": "", "device_id": ""}]}, {"id": "2633181f-4a01-4d84-90f6-a5731f569810", "create_time": 1774369050.41261, "update_time": 1774369237.41772, "last_job_id": 0, "name": "restrict app execution - Windows Defender ATP", "action": "9033", "description": "Restrict execution of all applications on the device except a predefined set", "type": "restrict app execution", "app_id": 191, "asset": 45, "parameters": [{"comment": "", "timeout": "", "device_id": ""}]}, {"id": "6aba6f5c-de89-42ce-9f8c-f7c6c3f2025f", "create_time": 1774369050.4126487, "update_time": 1774369237.4177527, "last_job_id": 0, "name": "block hash - Carbon Black Response", "action": "8753", "description": "Add a hash to the Carbon Black Response blacklist", "type": "block hash", "app_id": 48, "asset": 10, "parameters": [{"hash": "", "comment": ""}]}, {"id": "a9730e94-af88-47b6-9385-1a2eeab4ae23", "create_time": 1774369050.4126875, "update_time": 1774369237.4178016, "last_job_id": 0, "name": "quarantine device - Carbon Black Response", "action": "8740", "description": "Quarantine the endpoint", "type": "quarantine device", "app_id": 48, "asset": 10, "parameters": [{"ip_hostname": ""}]}, {"id": "63dab96c-8898-4f2c-bcac-4aa185649409", "create_time": 1774369050.4127262, "update_time": 1774369237.4178364, "last_job_id": 0, "name": "terminate process - Carbon Black Response", "action": "8745", "description": "Kill running processes on a machine", "type": "terminate process", "app_id": 48, "asset": 10, "parameters": [{"pid": "", "sensor_id": "", "ip_hostname": ""}]}, {"id": "12a53b6c-64c5-4f34-b550-d340bf1873ee", "create_time": 1774369050.412777, "update_time": 1774369237.4178708, "last_job_id": 0, "name": "reset session - Carbon Black Response", "action": "8751", "description": "Tell the server to reset the sensor \"sensor_wait_timeout\"", "type": "reset session", "app_id": 48, "asset": 10, "parameters": [{"session_id": ""}]}, {"id": "20252f6b-dcdd-4686-8818-b233a66f5626", "create_time": 1774369050.412818, "update_time": 1774369237.4179046, "last_job_id": 0, "name": "disable tokens - MS Graph for Active Directory", "action": "9250", "description": "Invalidate all active refresh tokens for a user in a Microsoft AD environment", "type": "disable tokens", "app_id": 174, "asset": 37, "parameters": [{"user_id": ""}]}, {"id": "7e79a35f-5e12-4220-bf3c-8a4ad5d5d551", "create_time": 1774369050.412857, "update_time": 1774369237.417938, "last_job_id": 0, "name": "disable account - AD LDAP", "action": "8679", "description": "Disables an Active Directory account", "type": "disable account", "app_id": 1, "asset": 8, "parameters": [{"user": "", "use_samaccountname": false}]}, {"id": "aa810b5d-c297-4fb9-b193-977b54fde967", "create_time": 1774369050.412897, "update_time": 1774369237.4179714, "last_job_id": 0, "name": "disable tokens - Azure AD Graph", "action": "8720", "description": "Invalidate all active refresh tokens for a user in an Azure AD environment", "type": "disable tokens", "app_id": 30, "asset": 39, "parameters": [{"user_id": ""}]}, {"id": "4fb5120d-0206-4020-82d1-418ede7b6df0", "create_time": 1774369050.4129357, "update_time": 1774369237.4180045, "last_job_id": 0, "name": "disable user - Azure AD Graph", "action": "8722", "description": "Disable a user", "type": "disable user", "app_id": 30, "asset": 39, "parameters": [{"user_id": ""}]}, {"id": "85cf2238-a919-4410-a5db-340a87a4f81a", "create_time": 1774369050.4129748, "update_time": 1774369237.4180377, "last_job_id": 0, "name": "disable user - AWS IAM", "action": "211", "description": "Disable login profile and access keys of a user", "type": "disable user", "app_id": 10, "asset": 38, "parameters": [{"username": "", "credentials": "", "disable_access_keys": false}]}, {"id": "4e09ad9a-9601-4cfa-9db9-d746e05c1f35", "create_time": 1774369050.413014, "update_time": 1774369237.4180715, "last_job_id": 0, "name": "disable user - Okta", "action": "8889", "description": "Disables the specified user", "type": "disable user", "app_id": 215, "asset": 17, "parameters": [{"id": ""}]}, {"id": "1df10219-62df-4884-9043-09a29b06c0f3", "create_time": 1774369050.4130533, "update_time": 1774369237.418115, "last_job_id": 0, "name": "disable user - MS Graph for Active Directory", "action": "9252", "description": "Disable a user", "type": "disable user", "app_id": 174, "asset": 37, "parameters": [{"user_id": ""}]}], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0}]}, {"id": "37031e87-5234-4694-a5d9-cff1c29f8f4d", "create_time": 1774368230.650808, "update_time": 1774369237.4184585, "name": "Eradicate", "order": 3, "tasks": [{"id": "31e6eacc-4f57-4329-b146-8d3f689e3086", "create_time": 1764758755.7606778, "update_time": 1774369237.4182205, "name": "Identify and mitigate all vulnerabilities", "order": 1, "tag": "f0381ae6-f28f-402a-9f05-3e990496dd50", "description": "Identify%20and%20mitigate%20all%20vulnerabilities%20that%20were%20exploited.%0A%0ASuggested%20Dashboards%0A1.%20%5BTraffic%20Center%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/traffic_center)%0A2.%20%5BEndpoint%20Changes%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/endpoint_changes)%0A3.%20%5BMalware%20Center%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/malware_center)%0A4.%20%5BMalware%20Search%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/malware_search)%0A5.%20%5BEmail%20Search%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/email_search)%0A6.%20%5BRisk%20Analysis%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/risk_analysis)", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0}, {"id": "680e54ac-3708-4d38-884f-20a1a7edf0de", "create_time": 1764758755.7608309, "update_time": 1774369237.418317, "name": "Remove malicious content", "order": 2, "tag": "e7029c6f-cce7-4c43-9a1c-b0425432ad81", "description": "Remove%20malware,%20inappropriate%20materials%20and%20other%20components.%0A%0A", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0}, {"id": "a41b242d-1640-4d15-8104-ec399e12d1de", "create_time": 1764758755.7609744, "update_time": 1774369237.4183993, "name": "Verify no other hosts are affected", "order": 3, "tag": "7e41266d-aa31-4b86-b2f4-47f68023fb3e", "description": "If%20more%20affected%20hosts%20are%20discovered,%20repeat%20the%20Detection%20and%20Analysis%20Steps.%0A%0ASuggested%20Dashboards%0A1.%20%5BAnalyst%20Queue%5D(/app/SplunkEnterpriseSecuritySuite/incident_review)%0A2.%20%5BTraffic%20Center%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/traffic_center)%0A3.%20%5BEndpoint%20Changes%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/endpoint_changes)%0A4.%20%5BMalware%20Center%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/malware_center)", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0}]}, {"id": "b12466ec-8616-4519-b133-f6d93f9e32c4", "create_time": 1774368230.651252, "update_time": 1774369237.4187126, "name": "Recovery", "order": 4, "tasks": [{"id": "43ba0f0e-1fda-4051-a97b-8f7f4682ac33", "create_time": 1764758755.7611475, "update_time": 1774369237.4185226, "name": "Restore affected systems", "order": 1, "tag": "3a888228-8354-43a5-809b-41e85114db15", "description": "Return affected systems to an operationally ready state.", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0}, {"id": "579fa706-4719-4a36-92a0-8c89395b18e6", "create_time": 1764758755.7612762, "update_time": 1774369237.4185958, "name": "Validate restoration", "order": 2, "tag": "39fc29b1-1047-4d0c-bd88-4581b10fe376", "description": "Confirm that the affected systems are functioning normally.", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0}, {"id": "080aeef1-8fb9-40e2-863e-428fd8f7f017", "create_time": 1764758755.7614079, "update_time": 1774369237.4186695, "name": "Implement additional monitoring", "order": 3, "tag": "7d818e21-eb6b-48ef-92fa-e5c447194ae0", "description": "If necessary, implement additional monitoring to look for future activity.", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0}]}, {"id": "1ec64d29-231e-4c34-aec1-4aee974fc8df", "create_time": 1774368230.6515594, "update_time": 1774369237.4189074, "name": "Post Incident Activity", "order": 5, "tasks": [{"id": "bab81f67-66e8-4326-be3c-6c11894e50c7", "create_time": 1764758755.7615948, "update_time": 1774369237.4187906, "name": "Create a follow-up report", "order": 1, "tag": "e0d07d6c-00cb-44bc-8536-c8eeda5470a9", "description": "", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0}, {"id": "b77497e1-95ce-4ebe-8b62-4929dbfdd8a5", "create_time": 1764758755.7616863, "update_time": 1774369237.4188647, "name": "Lessons learned", "order": 2, "tag": "95974f42-e739-440a-ba79-00fc2d32a7ad", "description": "Hold a lessons learned meeting (mandatory for major incidents, optional otherwise).", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0}]}], "origin": {}, "template_id": "f9f6f0b5-4b9d-4e73-9b6c-11dadd1f38c8", "active": true, "used": false, "ai_generated": false, "source_attachment_id": null, "_user": "nobody", "_key": "9f9a07d2-5ddd-4da5-85b7-1fd091a7d281"}