Collapse file tree

Files

 develop

Search this repository

/

playbooks

/

Copy path

Directory actions

More options

More options

Directory actions

More options

More options

Latest commit

ljstella

Updated links in playbook yamls

Jun 24, 2025

e2b479c · Jun 24, 2025

History

History

Open commit details

/

playbooks

/

Top

Folders and files

Name		Name	Last commit message	Last commit date
parent directory ..
custom_functions		custom_functions	Updated indicator_collect CF	Mar 28, 2022
AD_LDAP_Account_Locking.json		AD_LDAP_Account_Locking.json	AD LDAP Account Locking Tag Fix	Aug 17, 2023
AD_LDAP_Account_Locking.png		AD_LDAP_Account_Locking.png	ad_ldap_account_locking_playbook	May 17, 2023
AD_LDAP_Account_Locking.py		AD_LDAP_Account_Locking.py	AD LDAP Account Locking Tag Fix	Aug 17, 2023
AD_LDAP_Account_Locking.yml		AD_LDAP_Account_Locking.yml	ESCU Release Branch v4.27.0	Mar 20, 2024
AD_LDAP_Account_Unlocking.json		AD_LDAP_Account_Unlocking.json	Fixed dispatch and feedback	Aug 14, 2023
AD_LDAP_Account_Unlocking.png		AD_LDAP_Account_Unlocking.png	Created playbook	Jun 22, 2023
AD_LDAP_Account_Unlocking.py		AD_LDAP_Account_Unlocking.py	Swap block name	Jun 23, 2023
AD_LDAP_Account_Unlocking.yml		AD_LDAP_Account_Unlocking.yml	Fixed dispatch and feedback	Aug 14, 2023
AD_LDAP_Entity_Attribute_Lookup.json		AD_LDAP_Entity_Attribute_Lookup.json	AD LDAP Entity Attributes Lookup playbook	Mar 6, 2023
AD_LDAP_Entity_Attribute_Lookup.png		AD_LDAP_Entity_Attribute_Lookup.png	AD LDAP Entity Attributes Lookup playbook	Mar 6, 2023
AD_LDAP_Entity_Attribute_Lookup.py		AD_LDAP_Entity_Attribute_Lookup.py	AD LDAP Entity Attributes Lookup playbook	Mar 6, 2023
AD_LDAP_Entity_Attribute_Lookup.yml		AD_LDAP_Entity_Attribute_Lookup.yml	Updated ymls	Aug 16, 2023
AWS_IAM_Account_Locking.json		AWS_IAM_Account_Locking.json	Update description	Aug 2, 2023
AWS_IAM_Account_Locking.png		AWS_IAM_Account_Locking.png	AWS_IAM_Account_Locking_Playbook	May 10, 2023
AWS_IAM_Account_Locking.py		AWS_IAM_Account_Locking.py	AWS_IAM_Account_Locking_Playbook	May 25, 2023
AWS_IAM_Account_Locking.yml		AWS_IAM_Account_Locking.yml	ESCU Release Branch v4.27.0	Mar 20, 2024
AWS_IAM_Account_Unlocking.json		AWS_IAM_Account_Unlocking.json	Resolved feedback	Aug 14, 2023
AWS_IAM_Account_Unlocking.png		AWS_IAM_Account_Unlocking.png	Created playbook	Jun 22, 2023
AWS_IAM_Account_Unlocking.py		AWS_IAM_Account_Unlocking.py	Resolved feedback	Aug 14, 2023
AWS_IAM_Account_Unlocking.yml		AWS_IAM_Account_Unlocking.yml	ESCU Release v4.31.0	May 8, 2024
Active_Directory_Disable_Account_Dispatch.json		Active_Directory_Disable_Account_Dispatch.json	Active Directory Disable Account Dispatch tag fix	Aug 17, 2023
Active_Directory_Disable_Account_Dispatch.png		Active_Directory_Disable_Account_Dispatch.png	Updated playbook to fix bugs	Jul 26, 2023
Active_Directory_Disable_Account_Dispatch.py		Active_Directory_Disable_Account_Dispatch.py	Active Directory Disable Account Dispatch tag fix	Aug 17, 2023
Active_Directory_Disable_Account_Dispatch.yml		Active_Directory_Disable_Account_Dispatch.yml	ESCU Release v4.31.0	May 8, 2024
Active_Directory_Enable_Account_Dispatch.json		Active_Directory_Enable_Account_Dispatch.json	Accidentally a letter	Aug 17, 2023
Active_Directory_Enable_Account_Dispatch.png		Active_Directory_Enable_Account_Dispatch.png	Resolved Bug	Jul 13, 2023
Active_Directory_Enable_Account_Dispatch.py		Active_Directory_Enable_Account_Dispatch.py	Resolved feedback	Aug 14, 2023
Active_Directory_Enable_Account_Dispatch.yml		Active_Directory_Enable_Account_Dispatch.yml	ESCU Release v4.31.0	May 8, 2024
Attribute_Lookup_Dispatch.json		Attribute_Lookup_Dispatch.json	Moved dispatch to end of playbook name	Apr 12, 2023
Attribute_Lookup_Dispatch.png		Attribute_Lookup_Dispatch.png	Moved dispatch to end of playbook name	Apr 12, 2023
Attribute_Lookup_Dispatch.py		Attribute_Lookup_Dispatch.py	Moved dispatch to end of playbook name	Apr 12, 2023
Attribute_Lookup_Dispatch.yml		Attribute_Lookup_Dispatch.yml	Updated ymls	Aug 16, 2023
Automated_Enrichment.json		Automated_Enrichment.json	Fixed automated enrichment to reference renamed playbooks	Sep 8, 2023
Automated_Enrichment.png		Automated_Enrichment.png	Fixed automated enrichment to reference renamed playbooks	Sep 8, 2023
Automated_Enrichment.py		Automated_Enrichment.py	Fixed automated enrichment to reference renamed playbooks	Sep 8, 2023
Automated_Enrichment.yml		Automated_Enrichment.yml	Fixed automated enrichment to reference renamed playbooks	Sep 8, 2023
Azure_AD_Account_Locking.json		Azure_AD_Account_Locking.json	Azure AD Account Locking tag fix	Aug 17, 2023
Azure_AD_Account_Locking.png		Azure_AD_Account_Locking.png	Azure_AD_Locking_Playbook	May 25, 2023
Azure_AD_Account_Locking.py		Azure_AD_Account_Locking.py	Azure AD Account Locking tag fix	Aug 17, 2023
Azure_AD_Account_Locking.yml		Azure_AD_Account_Locking.yml	ESCU Release Branch v4.27.0	Mar 20, 2024
Azure_AD_Account_Unlocking.json		Azure_AD_Account_Unlocking.json	fix dispatch	Aug 14, 2023
Azure_AD_Account_Unlocking.png		Azure_AD_Account_Unlocking.png	Resolved feedback	Aug 14, 2023
Azure_AD_Account_Unlocking.py		Azure_AD_Account_Unlocking.py	Resolved feedback	Aug 14, 2023
Azure_AD_Account_Unlocking.yml		Azure_AD_Account_Unlocking.yml	ESCU Release Branch v4.27.0	Mar 20, 2024
Azure_AD_Graph_User_Attribute_Lookup.json		Azure_AD_Graph_User_Attribute_Lookup.json	Azure AD Graph User Attribute Lookup Playbook	Mar 6, 2023
Azure_AD_Graph_User_Attribute_Lookup.png		Azure_AD_Graph_User_Attribute_Lookup.png	Azure AD Graph User Attribute Lookup Playbook	Mar 6, 2023
Azure_AD_Graph_User_Attribute_Lookup.py		Azure_AD_Graph_User_Attribute_Lookup.py	Azure AD Graph User Attribute Lookup Playbook	Mar 6, 2023
Azure_AD_Graph_User_Attribute_Lookup.yml		Azure_AD_Graph_User_Attribute_Lookup.yml	Updated ymls	Aug 16, 2023
CiscoTalosIntelligence_Identifier_Reputation_Analysis.png		CiscoTalosIntelligence_Identifier_Reputation_Analysis.png	Renaming file again, maybe this won't break	Jan 30, 2025
Cisco_Talos_Intelligence_Identifier_Reputation_Analysis.json		Cisco_Talos_Intelligence_Identifier_Reputation_Analysis.json	Renaming again for a new reason	Jan 30, 2025
Cisco_Talos_Intelligence_Identifier_Reputation_Analysis.py		Cisco_Talos_Intelligence_Identifier_Reputation_Analysis.py	adding the playbook files	Jan 17, 2025
Cisco_Talos_Intelligence_Identifier_Reputation_Analysis.yml		Cisco_Talos_Intelligence_Identifier_Reputation_Analysis.yml	Renaming again for a new reason	Jan 30, 2025
Cisco_Umbrella_DNS_Denylisting.json		Cisco_Umbrella_DNS_Denylisting.json	bug fix	Aug 2, 2023
Cisco_Umbrella_DNS_Denylisting.png		Cisco_Umbrella_DNS_Denylisting.png	update screenshot	Aug 2, 2023
Cisco_Umbrella_DNS_Denylisting.py		Cisco_Umbrella_DNS_Denylisting.py	bug fix	Aug 2, 2023
Cisco_Umbrella_DNS_Denylisting.yml		Cisco_Umbrella_DNS_Denylisting.yml	ESCU Release Branch v4.27.0	Mar 20, 2024
CrowdStrike_OAuth_API_Device_Attribute_Lookup.json		CrowdStrike_OAuth_API_Device_Attribute_Lookup.json	Crowdstrike OAuth API Device Attribute Lookup playbook	Mar 6, 2023
CrowdStrike_OAuth_API_Device_Attribute_Lookup.png		CrowdStrike_OAuth_API_Device_Attribute_Lookup.png	Crowdstrike OAuth API Device Attribute Lookup playbook	Mar 6, 2023
CrowdStrike_OAuth_API_Device_Attribute_Lookup.py		CrowdStrike_OAuth_API_Device_Attribute_Lookup.py	Crowdstrike OAuth API Device Attribute Lookup playbook	Mar 6, 2023
CrowdStrike_OAuth_API_Device_Attribute_Lookup.yml		CrowdStrike_OAuth_API_Device_Attribute_Lookup.yml	Updated ymls	Aug 16, 2023
CrowdStrike_OAuth_API_Dynamic_Analysis.json		CrowdStrike_OAuth_API_Dynamic_Analysis.json	crowdstrike_oauth_api_playbook_v2	Apr 13, 2023
CrowdStrike_OAuth_API_Dynamic_Analysis.png		CrowdStrike_OAuth_API_Dynamic_Analysis.png	crowdstrike_oauth_api_playbook_v2	Mar 30, 2023
CrowdStrike_OAuth_API_Dynamic_Analysis.py		CrowdStrike_OAuth_API_Dynamic_Analysis.py	crowdstrike_oauth_api_playbook_v2	Apr 13, 2023
CrowdStrike_OAuth_API_Dynamic_Analysis.yml		CrowdStrike_OAuth_API_Dynamic_Analysis.yml	ESCU Release Branch v4.27.0	Mar 20, 2024
CrowdStrike_OAuth_API_Identifier_Activity_Analysis.json		CrowdStrike_OAuth_API_Identifier_Activity_Analysis.json	Addressed Kelby's points	May 4, 2023
CrowdStrike_OAuth_API_Identifier_Activity_Analysis.png		CrowdStrike_OAuth_API_Identifier_Activity_Analysis.png	Initial Commit- CrowdStrike OAuth API Identifier Activity Analysis	Mar 30, 2023
CrowdStrike_OAuth_API_Identifier_Activity_Analysis.py		CrowdStrike_OAuth_API_Identifier_Activity_Analysis.py	Addressed Kelby's points	May 4, 2023
CrowdStrike_OAuth_API_Identifier_Activity_Analysis.yml		CrowdStrike_OAuth_API_Identifier_Activity_Analysis.yml	ESCU Release Branch v4.27.0	Mar 20, 2024
DNS_Denylisting_Dispatch.json		DNS_Denylisting_Dispatch.json	bug fix	Aug 2, 2023
DNS_Denylisting_Dispatch.png		DNS_Denylisting_Dispatch.png	bug fix	Aug 2, 2023
DNS_Denylisting_Dispatch.py		DNS_Denylisting_Dispatch.py	bug fix	Aug 2, 2023
DNS_Denylisting_Dispatch.yml		DNS_Denylisting_Dispatch.yml	ESCU Release Branch v4.27.0	Mar 20, 2024
Dynamic_Analysis_Dispatch.json		Dynamic_Analysis_Dispatch.json	Fixed reference to different playbook.	Apr 29, 2023
Dynamic_Analysis_Dispatch.png		Dynamic_Analysis_Dispatch.png	Made required changes. See description.	Apr 29, 2023
Dynamic_Analysis_Dispatch.py		Dynamic_Analysis_Dispatch.py	Fixed reference to different playbook.	Apr 29, 2023
Dynamic_Analysis_Dispatch.yml		Dynamic_Analysis_Dispatch.yml	ESCU Release v4.31.0	May 8, 2024
G_Suite_for_GMail_Message_Identifier_Activity_Analysis.json		G_Suite_for_GMail_Message_Identifier_Activity_Analysis.json	ESCU v4.26.0 Release branch	Mar 6, 2024
G_Suite_for_GMail_Message_Identifier_Activity_Analysis.png		G_Suite_for_GMail_Message_Identifier_Activity_Analysis.png	Updated to remove non-results	May 23, 2023
G_Suite_for_GMail_Message_Identifier_Activity_Analysis.py		G_Suite_for_GMail_Message_Identifier_Activity_Analysis.py	ESCU v4.26.0 Release branch	Mar 6, 2024
G_Suite_for_GMail_Message_Identifier_Activity_Analysis.yml		G_Suite_for_GMail_Message_Identifier_Activity_Analysis.yml	ESCU Release Branch v4.27.0	Mar 20, 2024
G_Suite_for_Gmail_Message_Eviction.json		G_Suite_for_Gmail_Message_Eviction.json	ESCU v4.26.0 Release branch	Mar 6, 2024
G_Suite_for_Gmail_Message_Eviction.png		G_Suite_for_Gmail_Message_Eviction.png	ESCU v4.26.0 Release branch	Mar 6, 2024
G_Suite_for_Gmail_Message_Eviction.py		G_Suite_for_Gmail_Message_Eviction.py	ESCU v4.26.0 Release branch	Mar 6, 2024
G_Suite_for_Gmail_Message_Eviction.yml		G_Suite_for_Gmail_Message_Eviction.yml	ESCU Release Branch v4.27.0	Mar 20, 2024
G_Suite_for_Gmail_Search_and_Purge.json		G_Suite_for_Gmail_Search_and_Purge.json	ESCU v4.26.0 Release branch	Mar 6, 2024
G_Suite_for_Gmail_Search_and_Purge.png		G_Suite_for_Gmail_Search_and_Purge.png	ESCU v4.26.0 Release branch	Mar 6, 2024
G_Suite_for_Gmail_Search_and_Purge.py		G_Suite_for_Gmail_Search_and_Purge.py	ESCU v4.26.0 Release branch	Mar 6, 2024
G_Suite_for_Gmail_Search_and_Purge.yml		G_Suite_for_Gmail_Search_and_Purge.yml	ESCU v4.26.0 Release branch	Mar 6, 2024
Identifier_Activity_Analysis_Dispatch.json		Identifier_Activity_Analysis_Dispatch.json	Last style update	May 19, 2023
Identifier_Activity_Analysis_Dispatch.png		Identifier_Activity_Analysis_Dispatch.png	Identifier Activity Analysis Dispatch	Apr 10, 2023
Identifier_Activity_Analysis_Dispatch.py		Identifier_Activity_Analysis_Dispatch.py	Last style update	May 19, 2023
Identifier_Activity_Analysis_Dispatch.yml		Identifier_Activity_Analysis_Dispatch.yml	ESCU Release Branch v4.27.0	Mar 20, 2024
Identifier_Reputation_Analysis_Dispatch.json		Identifier_Reputation_Analysis_Dispatch.json	Moved dispatch to end of playbook name	Apr 12, 2023
Identifier_Reputation_Analysis_Dispatch.png		Identifier_Reputation_Analysis_Dispatch.png	Moved dispatch to end of playbook name	Apr 12, 2023
Identifier_Reputation_Analysis_Dispatch.py		Identifier_Reputation_Analysis_Dispatch.py	Moved dispatch to end of playbook name	Apr 12, 2023
Identifier_Reputation_Analysis_Dispatch.yml		Identifier_Reputation_Analysis_Dispatch.yml	ESCU Release Branch v4.27.0	Mar 20, 2024
Jira_Related_Tickets_Search.json		Jira_Related_Tickets_Search.json	Update playbook to fix None assignee and support dispatch playbook	Aug 23, 2023
Jira_Related_Tickets_Search.png		Jira_Related_Tickets_Search.png	Add playbook Jira_Related_Tickets_Search	Aug 9, 2023
Jira_Related_Tickets_Search.py		Jira_Related_Tickets_Search.py	Update playbook to fix None assignee and support dispatch playbook	Aug 23, 2023
Jira_Related_Tickets_Search.yml		Jira_Related_Tickets_Search.yml	ESCU Release Branch v4.27.0	Mar 20, 2024
MS_Graph_for_Office_365_Message_Eviction.json		MS_Graph_for_Office_365_Message_Eviction.json	ESCU v4.26.0 Release branch	Mar 6, 2024
MS_Graph_for_Office_365_Message_Eviction.png		MS_Graph_for_Office_365_Message_Eviction.png	ESCU v4.26.0 Release branch	Mar 6, 2024
MS_Graph_for_Office_365_Message_Eviction.py		MS_Graph_for_Office_365_Message_Eviction.py	ESCU v4.26.0 Release branch	Mar 6, 2024
MS_Graph_for_Office_365_Message_Eviction.yml		MS_Graph_for_Office_365_Message_Eviction.yml	ESCU Release Branch v4.27.0	Mar 20, 2024
MS_Graph_for_Office_365_Message_Identifier_Activity_Analysis.json		MS_Graph_for_Office_365_Message_Identifier_Activity_Analysis.json	ESCU v4.26.0 Release branch	Mar 6, 2024
MS_Graph_for_Office_365_Message_Identifier_Activity_Analysis.png		MS_Graph_for_Office_365_Message_Identifier_Activity_Analysis.png	ESCU v4.26.0 Release branch	Mar 6, 2024
MS_Graph_for_Office_365_Message_Identifier_Activity_Analysis.py		MS_Graph_for_Office_365_Message_Identifier_Activity_Analysis.py	ESCU v4.26.0 Release branch	Mar 6, 2024
MS_Graph_for_Office_365_Message_Identifier_Activity_Analysis.yml		MS_Graph_for_Office_365_Message_Identifier_Activity_Analysis.yml	ESCU Release Branch v4.27.0	Mar 20, 2024
MS_Graph_for_Office_365_Message_Restore.json		MS_Graph_for_Office_365_Message_Restore.json	ESCU v4.26.0 Release branch	Mar 6, 2024
MS_Graph_for_Office_365_Message_Restore.png		MS_Graph_for_Office_365_Message_Restore.png	ESCU v4.26.0 Release branch	Mar 6, 2024
MS_Graph_for_Office_365_Message_Restore.py		MS_Graph_for_Office_365_Message_Restore.py	ESCU v4.26.0 Release branch	Mar 6, 2024
MS_Graph_for_Office_365_Message_Restore.yml		MS_Graph_for_Office_365_Message_Restore.yml	ESCU Release Branch v4.27.0	Mar 20, 2024
MS_Graph_for_Office_365_Search_and_Purge.json		MS_Graph_for_Office_365_Search_and_Purge.json	ESCU v4.26.0 Release branch	Mar 6, 2024
MS_Graph_for_Office_365_Search_and_Purge.png		MS_Graph_for_Office_365_Search_and_Purge.png	ESCU v4.26.0 Release branch	Mar 6, 2024
MS_Graph_for_Office_365_Search_and_Purge.py		MS_Graph_for_Office_365_Search_and_Purge.py	ESCU v4.26.0 Release branch	Mar 6, 2024
MS_Graph_for_Office_365_Search_and_Purge.yml		MS_Graph_for_Office_365_Search_and_Purge.yml	ESCU Release v4.31.0	May 8, 2024
MS_Graph_for_Office_365_Search_and_Restore.json		MS_Graph_for_Office_365_Search_and_Restore.json	ESCU v4.26.0 Release branch	Mar 6, 2024
MS_Graph_for_Office_365_Search_and_Restore.png		MS_Graph_for_Office_365_Search_and_Restore.png	ESCU v4.26.0 Release branch	Mar 6, 2024
MS_Graph_for_Office_365_Search_and_Restore.py		MS_Graph_for_Office_365_Search_and_Restore.py	ESCU v4.26.0 Release branch	Mar 6, 2024
MS_Graph_for_Office_365_Search_and_Restore.yml		MS_Graph_for_Office_365_Search_and_Restore.yml	ESCU Release v4.31.0	May 8, 2024
Panorama_Outbound_Traffic_Filtering.json		Panorama_Outbound_Traffic_Filtering.json	Fixed based on the given feedback	Jun 21, 2023
Panorama_Outbound_Traffic_Filtering.png		Panorama_Outbound_Traffic_Filtering.png	Fixed based on the given feedback	Jun 21, 2023
Panorama_Outbound_Traffic_Filtering.py		Panorama_Outbound_Traffic_Filtering.py	Fixed based on the given feedback	Jun 21, 2023
Panorama_Outbound_Traffic_Filtering.yml		Panorama_Outbound_Traffic_Filtering.yml	ESCU Release Branch v4.27.0	Mar 20, 2024
PhishTank_URL_Reputation_Analysis.json		PhishTank_URL_Reputation_Analysis.json	new SOAR content	Jan 11, 2023
PhishTank_URL_Reputation_Analysis.png		PhishTank_URL_Reputation_Analysis.png	new SOAR content	Jan 11, 2023
PhishTank_URL_Reputation_Analysis.py		PhishTank_URL_Reputation_Analysis.py	new SOAR content	Jan 11, 2023
PhishTank_URL_Reputation_Analysis.yml		PhishTank_URL_Reputation_Analysis.yml	ESCU Release Branch v4.27.0	Mar 20, 2024
Related_Tickets_Search_Dispatch.json		Related_Tickets_Search_Dispatch.json	Fixed inconsistent playbook categories	Jun 5, 2023
Related_Tickets_Search_Dispatch.png		Related_Tickets_Search_Dispatch.png	Moved dispatch to end of playbook name	Apr 12, 2023
Related_Tickets_Search_Dispatch.py		Related_Tickets_Search_Dispatch.py	Moved dispatch to end of playbook name	Apr 12, 2023
Related_Tickets_Search_Dispatch.yml		Related_Tickets_Search_Dispatch.yml	Updated ymls	Aug 16, 2023
ServiceNow_Related_Tickets_Search.json		ServiceNow_Related_Tickets_Search.json	Fixed inconsistent playbook categories	Jun 5, 2023
ServiceNow_Related_Tickets_Search.png		ServiceNow_Related_Tickets_Search.png	Copy content from phantomcyber/playbooks	Feb 27, 2023
ServiceNow_Related_Tickets_Search.py		ServiceNow_Related_Tickets_Search.py	Updating to keep in sync w/ phantomcyber/playbooks	Mar 3, 2023
ServiceNow_Related_Tickets_Search.yml		ServiceNow_Related_Tickets_Search.yml	ESCU Release Branch v4.27.0	Mar 20, 2024
Splunk_Attack_Analyzer_Dynamic_Analysis.json		Splunk_Attack_Analyzer_Dynamic_Analysis.json	Release Branch ESCU 4.23.0	Jan 30, 2024
Splunk_Attack_Analyzer_Dynamic_Analysis.png		Splunk_Attack_Analyzer_Dynamic_Analysis.png	Release Branch ESCU 4.23.0	Jan 30, 2024
Splunk_Attack_Analyzer_Dynamic_Analysis.py		Splunk_Attack_Analyzer_Dynamic_Analysis.py	Release Branch ESCU 4.23.0	Jan 30, 2024
Splunk_Attack_Analyzer_Dynamic_Analysis.yml		Splunk_Attack_Analyzer_Dynamic_Analysis.yml	ESCU Release Branch v4.27.0	Mar 20, 2024
Splunk_Automated_Email_Investigation.json		Splunk_Automated_Email_Investigation.json	Release Branch ESCU 4.23.0	Jan 30, 2024
Splunk_Automated_Email_Investigation.png		Splunk_Automated_Email_Investigation.png	Release Branch ESCU 4.23.0	Jan 30, 2024
Splunk_Automated_Email_Investigation.py		Splunk_Automated_Email_Investigation.py	Release Branch ESCU 4.23.0	Jan 30, 2024
Splunk_Automated_Email_Investigation.yml		Splunk_Automated_Email_Investigation.yml	ESCU Release Branch v4.27.0	Mar 20, 2024
Splunk_Identifier_Activity_Analysis.json		Splunk_Identifier_Activity_Analysis.json	Release Branch ESCU 4.23.0	Jan 30, 2024
Splunk_Identifier_Activity_Analysis.png		Splunk_Identifier_Activity_Analysis.png	Release Branch ESCU 4.23.0	Jan 30, 2024
Splunk_Identifier_Activity_Analysis.py		Splunk_Identifier_Activity_Analysis.py	Release Branch ESCU 4.23.0	Jan 30, 2024
Splunk_Identifier_Activity_Analysis.yml		Splunk_Identifier_Activity_Analysis.yml	ESCU Release Branch v4.27.0	Mar 20, 2024
Splunk_Message_Identifier_Activity_Analysis.json		Splunk_Message_Identifier_Activity_Analysis.json	Release Branch ESCU 4.23.0	Jan 30, 2024
Splunk_Message_Identifier_Activity_Analysis.png		Splunk_Message_Identifier_Activity_Analysis.png	Release Branch ESCU 4.23.0	Jan 30, 2024
Splunk_Message_Identifier_Activity_Analysis.py		Splunk_Message_Identifier_Activity_Analysis.py	Release Branch ESCU 4.23.0	Jan 30, 2024
Splunk_Message_Identifier_Activity_Analysis.yml		Splunk_Message_Identifier_Activity_Analysis.yml	ESCU Release Branch v4.27.0	Mar 20, 2024
Splunk_Notable_Related_Tickets_Search.json		Splunk_Notable_Related_Tickets_Search.json	Fixed inconsistent playbook categories	Jun 5, 2023
Splunk_Notable_Related_Tickets_Search.png		Splunk_Notable_Related_Tickets_Search.png	Updating to keep in sync w/ phantomcyber/playbooks	Mar 3, 2023
Splunk_Notable_Related_Tickets_Search.py		Splunk_Notable_Related_Tickets_Search.py	Updating to keep in sync w/ phantomcyber/playbooks	Mar 3, 2023
Splunk_Notable_Related_Tickets_Search.yml		Splunk_Notable_Related_Tickets_Search.yml	Updated ymls	Aug 16, 2023
URL_Outbound_Traffic_Filtering_Dispatch.json		URL_Outbound_Traffic_Filtering_Dispatch.json	URL Outbound Traffic Filtering Dispatch Playbook	May 22, 2023
URL_Outbound_Traffic_Filtering_Dispatch.png		URL_Outbound_Traffic_Filtering_Dispatch.png	URL Outbound Traffic Filtering Dispatch Playbook	May 22, 2023
URL_Outbound_Traffic_Filtering_Dispatch.py		URL_Outbound_Traffic_Filtering_Dispatch.py	URL Outbound Traffic Filtering Dispatch Playbook	May 22, 2023
URL_Outbound_Traffic_Filtering_Dispatch.yml		URL_Outbound_Traffic_Filtering_Dispatch.yml	ESCU Release Branch v4.27.0	Mar 20, 2024
UrlScan_IO_Dynamic_Analysis.json		UrlScan_IO_Dynamic_Analysis.json	minor_update_saa_urlscan_playbook	Apr 5, 2023
UrlScan_IO_Dynamic_Analysis.png		UrlScan_IO_Dynamic_Analysis.png	urlscan_io_dynamic_analysis_playbook	Mar 23, 2023
UrlScan_IO_Dynamic_Analysis.py		UrlScan_IO_Dynamic_Analysis.py	minor_update_saa_urlscan_playbook	Apr 5, 2023
UrlScan_IO_Dynamic_Analysis.yml		UrlScan_IO_Dynamic_Analysis.yml	ESCU Release Branch v4.27.0	Mar 20, 2024
VirusTotal_v3_Dynamic_Analysis.json		VirusTotal_v3_Dynamic_Analysis.json	VirusTotal Scoring Algo Fixes	Jun 7, 2023
VirusTotal_v3_Dynamic_Analysis.png		VirusTotal_v3_Dynamic_Analysis.png	virustotal_v3_dynamic_analysis_playbooks	Mar 23, 2023
VirusTotal_v3_Dynamic_Analysis.py		VirusTotal_v3_Dynamic_Analysis.py	VirusTotal Scoring Algo Fixes	Jun 7, 2023
VirusTotal_v3_Dynamic_Analysis.yml		VirusTotal_v3_Dynamic_Analysis.yml	ESCU Release Branch v4.27.0	Mar 20, 2024
VirusTotal_v3_Identifier_Reputation_Analysis.json		VirusTotal_v3_Identifier_Reputation_Analysis.json	VirusTotal Scoring Algo Fixes	Jun 7, 2023
VirusTotal_v3_Identifier_Reputation_Analysis.png		VirusTotal_v3_Identifier_Reputation_Analysis.png	new SOAR content	Jan 11, 2023
VirusTotal_v3_Identifier_Reputation_Analysis.py		VirusTotal_v3_Identifier_Reputation_Analysis.py	VirusTotal Scoring Algo Fixes	Jun 7, 2023
VirusTotal_v3_Identifier_Reputation_Analysis.yml		VirusTotal_v3_Identifier_Reputation_Analysis.yml	ESCU Release Branch v4.27.0	Mar 20, 2024
Windows_Defender_ATP_Identifier_Activity_Analysis.json		Windows_Defender_ATP_Identifier_Activity_Analysis.json	Addressed Kelby's Findings	May 4, 2023
Windows_Defender_ATP_Identifier_Activity_Analysis.png		Windows_Defender_ATP_Identifier_Activity_Analysis.png	Initial Commit - Windows Defender ATP Identifier Activity Analysis	Mar 30, 2023
Windows_Defender_ATP_Identifier_Activity_Analysis.py		Windows_Defender_ATP_Identifier_Activity_Analysis.py	Addressed Kelby's Findings	May 4, 2023
Windows_Defender_ATP_Identifier_Activity_Analysis.yml		Windows_Defender_ATP_Identifier_Activity_Analysis.yml	ESCU Release Branch v4.27.0	Mar 20, 2024
Zscaler_Outbound_Traffic_Filtering.json		Zscaler_Outbound_Traffic_Filtering.json	Improved the data paths	Jun 21, 2023
Zscaler_Outbound_Traffic_Filtering.png		Zscaler_Outbound_Traffic_Filtering.png	New ZScaler Playbook	Mar 31, 2023
Zscaler_Outbound_Traffic_Filtering.py		Zscaler_Outbound_Traffic_Filtering.py	Improved the data paths	Jun 21, 2023
Zscaler_Outbound_Traffic_Filtering.yml		Zscaler_Outbound_Traffic_Filtering.yml	ESCU Release v4.31.0	May 8, 2024
activedirectory_reset_password.json		activedirectory_reset_password.json	Adding custom functions & playbooks	Dec 8, 2021
activedirectory_reset_password.png		activedirectory_reset_password.png	Adding custom functions & playbooks	Dec 8, 2021
activedirectory_reset_password.py		activedirectory_reset_password.py	Adding custom functions & playbooks	Dec 8, 2021
activedirectory_reset_password.yml		activedirectory_reset_password.yml	ESCU Release v4.31.0	May 8, 2024
aws_disable_user_accounts.json		aws_disable_user_accounts.json	AWS Disable User Accounts	Feb 2, 2022
aws_disable_user_accounts.png		aws_disable_user_accounts.png	AWS Disable User Accounts	Feb 2, 2022
aws_disable_user_accounts.py		aws_disable_user_accounts.py	AWS Disable User Accounts	Feb 2, 2022
aws_disable_user_accounts.yml		aws_disable_user_accounts.yml	Update apps for consistency	Aug 22, 2023
aws_find_inactive_users.json		aws_find_inactive_users.json	AWS Find Inactive Users	Feb 1, 2022
aws_find_inactive_users.png		aws_find_inactive_users.png	AWS Find Inactive Users	Feb 1, 2022
aws_find_inactive_users.py		aws_find_inactive_users.py	AWS Find Inactive Users	Feb 1, 2022
aws_find_inactive_users.yml		aws_find_inactive_users.yml	Update apps for consistency	Aug 22, 2023
block_indicators.json		block_indicators.json	Added block_indicators playbook	Jan 5, 2022
block_indicators.png		block_indicators.png	Added block_indicators playbook	Jan 5, 2022
block_indicators.py		block_indicators.py	Added block_indicators playbook	Jan 5, 2022
block_indicators.yml		block_indicators.yml	Update apps for consistency	Aug 22, 2023
crowdstrike_malware_triage.json		crowdstrike_malware_triage.json	Adding custom functions & playbooks	Dec 8, 2021
crowdstrike_malware_triage.png		crowdstrike_malware_triage.png	Adding custom functions & playbooks	Dec 8, 2021
crowdstrike_malware_triage.py		crowdstrike_malware_triage.py	Adding custom functions & playbooks	Dec 8, 2021
crowdstrike_malware_triage.yml		crowdstrike_malware_triage.yml	Update crowdstrike_malware_triage.yml	Aug 23, 2023
delete_detected_files.json		delete_detected_files.json	Adding custom functions & playbooks	Dec 8, 2021
delete_detected_files.png		delete_detected_files.png	Adding custom functions & playbooks	Dec 8, 2021
delete_detected_files.py		delete_detected_files.py	Adding custom functions & playbooks	Dec 8, 2021
delete_detected_files.yml		delete_detected_files.yml	Added vpe_type tag to playbook yamls	Oct 26, 2022
email_notification_for_malware.json		email_notification_for_malware.json	Added email notification for malware playbook	Jan 5, 2022
email_notification_for_malware.png		email_notification_for_malware.png	Added email notification for malware playbook	Jan 5, 2022
email_notification_for_malware.py		email_notification_for_malware.py	Added email notification for malware playbook	Jan 5, 2022
email_notification_for_malware.yml		email_notification_for_malware.yml	Update apps for consistency	Aug 22, 2023
hunting.json		hunting.json	Adding hunting playbook	Jul 29, 2022
hunting.png		hunting.png	Adding hunting playbook	Jul 29, 2022
hunting.py		hunting.py	Adding hunting playbook	Jul 29, 2022
hunting.yml		hunting.yml	Update apps for consistency	Aug 22, 2023
internal_host_splunk_investigate_log4j.json		internal_host_splunk_investigate_log4j.json	Final copy from phantomcyber/playbooks	Dec 15, 2021
internal_host_splunk_investigate_log4j.png		internal_host_splunk_investigate_log4j.png	Final copy from phantomcyber/playbooks	Dec 15, 2021
internal_host_splunk_investigate_log4j.py		internal_host_splunk_investigate_log4j.py	Final copy from phantomcyber/playbooks	Dec 15, 2021
internal_host_splunk_investigate_log4j.yml		internal_host_splunk_investigate_log4j.yml	ESCU Release v4.31.0	May 8, 2024
internal_host_ssh_investigate.json		internal_host_ssh_investigate.json	Final copy from phantomcyber/playbooks	Dec 15, 2021
internal_host_ssh_investigate.png		internal_host_ssh_investigate.png	Final copy from phantomcyber/playbooks	Dec 15, 2021
internal_host_ssh_investigate.py		internal_host_ssh_investigate.py	Final copy from phantomcyber/playbooks	Dec 15, 2021
internal_host_ssh_investigate.yml		internal_host_ssh_investigate.yml	Added vpe_type tag to playbook yamls	Oct 26, 2022
internal_host_ssh_log4j_investigate.json		internal_host_ssh_log4j_investigate.json	Final copy from phantomcyber/playbooks	Dec 15, 2021
internal_host_ssh_log4j_investigate.png		internal_host_ssh_log4j_investigate.png	... and another one	Dec 15, 2021
internal_host_ssh_log4j_investigate.py		internal_host_ssh_log4j_investigate.py	Final copy from phantomcyber/playbooks	Dec 15, 2021
internal_host_ssh_log4j_investigate.yml		internal_host_ssh_log4j_investigate.yml	Added vpe_type tag to playbook yamls	Oct 26, 2022
internal_host_ssh_log4j_respond.json		internal_host_ssh_log4j_respond.json	Final copy from phantomcyber/playbooks	Dec 15, 2021
internal_host_ssh_log4j_respond.png		internal_host_ssh_log4j_respond.png	Final copy from phantomcyber/playbooks	Dec 15, 2021
internal_host_ssh_log4j_respond.py		internal_host_ssh_log4j_respond.py	Final copy from phantomcyber/playbooks	Dec 15, 2021
internal_host_ssh_log4j_respond.yml		internal_host_ssh_log4j_respond.yml	ESCU Release v4.31.0	May 8, 2024
internal_host_winrm_investigate.json		internal_host_winrm_investigate.json	Final copy from phantomcyber/playbooks	Dec 15, 2021
internal_host_winrm_investigate.png		internal_host_winrm_investigate.png	Some playbooks	Dec 15, 2021
internal_host_winrm_investigate.py		internal_host_winrm_investigate.py	Final copy from phantomcyber/playbooks	Dec 15, 2021
internal_host_winrm_investigate.yml		internal_host_winrm_investigate.yml	Added vpe_type tag to playbook yamls	Oct 26, 2022
internal_host_winrm_log4j_investigate.json		internal_host_winrm_log4j_investigate.json	Final copy from phantomcyber/playbooks	Dec 15, 2021
internal_host_winrm_log4j_investigate.png		internal_host_winrm_log4j_investigate.png	Some playbooks	Dec 15, 2021
internal_host_winrm_log4j_investigate.py		internal_host_winrm_log4j_investigate.py	Final copy from phantomcyber/playbooks	Dec 15, 2021
internal_host_winrm_log4j_investigate.yml		internal_host_winrm_log4j_investigate.yml	Added vpe_type tag to playbook yamls	Oct 26, 2022
internal_host_winrm_log4j_respond.json		internal_host_winrm_log4j_respond.json	Final copy from phantomcyber/playbooks	Dec 15, 2021
internal_host_winrm_log4j_respond.png		internal_host_winrm_log4j_respond.png	Some playbooks	Dec 15, 2021
internal_host_winrm_log4j_respond.py		internal_host_winrm_log4j_respond.py	Final copy from phantomcyber/playbooks	Dec 15, 2021
internal_host_winrm_log4j_respond.yml		internal_host_winrm_log4j_respond.yml	ESCU Release v4.31.0	May 8, 2024
log4j_investigate.json		log4j_investigate.json	Final copy from phantomcyber/playbooks	Dec 15, 2021
log4j_investigate.png		log4j_investigate.png	divorced parent playbook	Dec 15, 2021
log4j_investigate.py		log4j_investigate.py	Final copy from phantomcyber/playbooks	Dec 15, 2021
log4j_investigate.yml		log4j_investigate.yml	Fix the ids associated with a number of playbooks and fix incorrectly…	Oct 6, 2023
log4j_respond.json		log4j_respond.json	Final copy from phantomcyber/playbooks	Dec 15, 2021
log4j_respond.png		log4j_respond.png	divorced parent playbook	Dec 15, 2021
log4j_respond.py		log4j_respond.py	Final copy from phantomcyber/playbooks	Dec 15, 2021
log4j_respond.yml		log4j_respond.yml	Fix the ids associated with a number of playbooks and fix incorrectly…	Oct 6, 2023
malware_hunt_and_contain.json		malware_hunt_and_contain.json	Added malware hunt and contain playbook	Jan 5, 2022
malware_hunt_and_contain.png		malware_hunt_and_contain.png	Added malware hunt and contain playbook	Jan 5, 2022
malware_hunt_and_contain.py		malware_hunt_and_contain.py	Added malware hunt and contain playbook	Jan 5, 2022
malware_hunt_and_contain.yml		malware_hunt_and_contain.yml	Update apps for consistency	Aug 22, 2023
ransomware_investigate_and_contain.json		ransomware_investigate_and_contain.json	Added demo playbook for development	Sep 16, 2021
ransomware_investigate_and_contain.png		ransomware_investigate_and_contain.png	Added demo playbook for development	Sep 16, 2021
ransomware_investigate_and_contain.py		ransomware_investigate_and_contain.py	Added demo playbook for development	Sep 16, 2021
ransomware_investigate_and_contain.yml		ransomware_investigate_and_contain.yml	Added vpe_type tag to playbook yamls	Oct 26, 2022
risk_notable_block_indicators.json		risk_notable_block_indicators.json	Updating playbooks	Jan 18, 2022
risk_notable_block_indicators.png		risk_notable_block_indicators.png	Initial commit	Nov 10, 2021
risk_notable_block_indicators.py		risk_notable_block_indicators.py	Updating playbooks	Jan 18, 2022
risk_notable_block_indicators.yml		risk_notable_block_indicators.yml	Updated links in playbook yamls	Jun 24, 2025
risk_notable_enrich.json		risk_notable_enrich.json	Updating playbooks	Jan 18, 2022
risk_notable_enrich.png		risk_notable_enrich.png	Initial commit	Nov 10, 2021
risk_notable_enrich.py		risk_notable_enrich.py	Updating playbooks	Jan 18, 2022
risk_notable_enrich.yml		risk_notable_enrich.yml	Updated links in playbook yamls	Jun 24, 2025
risk_notable_import_data.json		risk_notable_import_data.json	rollback changes to risk_notable_import_data files	Jan 23, 2025
risk_notable_import_data.png		risk_notable_import_data.png	Initial commit	Nov 10, 2021
risk_notable_import_data.py		risk_notable_import_data.py	Initial commit	Nov 10, 2021
risk_notable_import_data.yml		risk_notable_import_data.yml	Updated links in playbook yamls	Jun 24, 2025
risk_notable_investigate.json		risk_notable_investigate.json	Initial commit	Nov 10, 2021
risk_notable_investigate.png		risk_notable_investigate.png	Initial commit	Nov 10, 2021
risk_notable_investigate.py		risk_notable_investigate.py	Initial commit	Nov 10, 2021
risk_notable_investigate.yml		risk_notable_investigate.yml	Updated links in playbook yamls	Jun 24, 2025
risk_notable_merge_events.json		risk_notable_merge_events.json	Initial commit	Nov 10, 2021
risk_notable_merge_events.png		risk_notable_merge_events.png	Initial commit	Nov 10, 2021
risk_notable_merge_events.py		risk_notable_merge_events.py	Initial commit	Nov 10, 2021
risk_notable_merge_events.yml		risk_notable_merge_events.yml	Updated links in playbook yamls	Jun 24, 2025
risk_notable_mitigate.json		risk_notable_mitigate.json	Initial commit	Nov 10, 2021
risk_notable_mitigate.png		risk_notable_mitigate.png	Initial commit	Nov 10, 2021
risk_notable_mitigate.py		risk_notable_mitigate.py	Initial commit	Nov 10, 2021
risk_notable_mitigate.yml		risk_notable_mitigate.yml	Updated links in playbook yamls	Jun 24, 2025
risk_notable_preprocess.json		risk_notable_preprocess.json	Initial commit	Nov 10, 2021
risk_notable_preprocess.png		risk_notable_preprocess.png	Initial commit	Nov 10, 2021
risk_notable_preprocess.py		risk_notable_preprocess.py	Initial commit	Nov 10, 2021
risk_notable_preprocess.yml		risk_notable_preprocess.yml	Updated links in playbook yamls	Jun 24, 2025
risk_notable_protect_assets_and_users.json		risk_notable_protect_assets_and_users.json	Initial commit	Nov 10, 2021
risk_notable_protect_assets_and_users.png		risk_notable_protect_assets_and_users.png	Initial commit	Nov 10, 2021
risk_notable_protect_assets_and_users.py		risk_notable_protect_assets_and_users.py	Initial commit	Nov 10, 2021
risk_notable_protect_assets_and_users.yml		risk_notable_protect_assets_and_users.yml	Updated links in playbook yamls	Jun 24, 2025
risk_notable_review_indicators.json		risk_notable_review_indicators.json	Initial commit	Nov 10, 2021
risk_notable_review_indicators.png		risk_notable_review_indicators.png	Initial commit	Nov 10, 2021
risk_notable_review_indicators.py		risk_notable_review_indicators.py	Initial commit	Nov 10, 2021
risk_notable_review_indicators.yml		risk_notable_review_indicators.yml	Updated links in playbook yamls	Jun 24, 2025
risk_notable_verdict.json		risk_notable_verdict.json	Updating playbooks	Jan 18, 2022
risk_notable_verdict.png		risk_notable_verdict.png	Initial commit	Nov 10, 2021
risk_notable_verdict.py		risk_notable_verdict.py	Updating playbooks	Jan 18, 2022
risk_notable_verdict.yml		risk_notable_verdict.yml	Updated links in playbook yamls	Jun 24, 2025
start_investigation.json		start_investigation.json	Start Investigation	Feb 2, 2022
start_investigation.png		start_investigation.png	Start Investigation	Feb 2, 2022
start_investigation.py		start_investigation.py	Start Investigation	Feb 2, 2022
start_investigation.yml		start_investigation.yml	Added vpe_type tag to playbook yamls	Oct 26, 2022
threat_intel_investigate.json		threat_intel_investigate.json	Threat Intel Investigate	Feb 2, 2022
threat_intel_investigate.png		threat_intel_investigate.png	Threat Intel Investigate	Feb 2, 2022
threat_intel_investigate.py		threat_intel_investigate.py	Threat Intel Investigate	Feb 2, 2022
threat_intel_investigate.yml		threat_intel_investigate.yml	Added vpe_type tag to playbook yamls	Oct 26, 2022
trustar_enrich_indicators.json		trustar_enrich_indicators.json	TruSTAR Enrich Indicators	Feb 2, 2022
trustar_enrich_indicators.png		trustar_enrich_indicators.png	TruSTAR Enrich Indicators	Feb 2, 2022
trustar_enrich_indicators.py		trustar_enrich_indicators.py	TruSTAR Enrich Indicators	Feb 2, 2022
trustar_enrich_indicators.yml		trustar_enrich_indicators.yml	Added vpe_type tag to playbook yamls	Oct 26, 2022
View all files