dandye/adk_runbooks

detection-engineering-coverage-evaluation

Use when evaluating threat detection opportunities (TDOs), generating synthetic UDM events, evaluating Chronicle rule coverage, and drafting YARA-L 2.0 rules.

Quellsprache: Englisch

apt-threat-hunt

Use when hunting for advanced persistent threat (APT) actor activity, tools, and infrastructure.

Quellsprache: Englisch

lateral-movement-hunt-psexec-wmi

Use when hunting for lateral movement via PsExec, WMI, remote scheduled tasks, or WinRM.

Quellsprache: Englisch

proactive-hunt-gti-campaign

Use when initiating threat hunting operations driven by GTI threat campaign intelligence.

Quellsprache: Englisch

basic-ioc-enrichment

Use when conducting initial reputation and threat intelligence lookups on suspicious observables.

Quellsprache: Englisch

deep-dive-ioc-analysis

Use when performing exhaustive forensic and intelligence analysis on complex indicators of compromise.

Quellsprache: Englisch

investigate-case-external-tools

Use when enriching and verifying case artifacts with external threat intelligence platforms.

Quellsprache: Englisch

ioc-containment

Use when executing network, host, or credential containment actions for validated malicious IOCs.

Quellsprache: Englisch

prioritize-and-investigate-case

Use when scoring case urgency, prioritizing the queue, and running core investigations.

Quellsprache: Englisch

compromised-user-account-response

Use when executing containment, eradication, and recovery for confirmed compromised user credentials.

Quellsprache: Englisch

malware-incident-response

Use when coordinating response and remediation for advanced malware infections.

Quellsprache: Englisch

phishing-response

Use when responding to reported phishing emails, malicious links, or credential harvesting campaigns.

Quellsprache: Englisch

ransomware-response

Use when responding to active ransomware deployment, host encryption, or extortion threats.

Quellsprache: Englisch

create-investigation-report

Use when compiling comprehensive incident investigation findings and executive summaries.

Quellsprache: Englisch

cloud-vulnerability-triage

Use when triaging cloud security posture vulnerabilities and contextualizing finding risk.

Quellsprache: Englisch

malware-triage

Use when analyzing malware detection alerts, isolating infected endpoints, and scoping file executions.

Quellsprache: Englisch

suspicious-login-triage

Use when triaging anomalous or suspicious user authentication events, impossible travel, and credential anomalies.

Quellsprache: Englisch

triage-alerts

Use when evaluating and categorizing incoming security alerts to determine severity and initial response actions.

Quellsprache: Englisch

domain-get-gti-report

Use when fetching GTI threat reputation and WHOIS intelligence for a specific domain name.

Quellsprache: Englisch

domain-get-secops-threat-intel

Use when retrieving Chronicle SecOps threat intelligence and IOC matches for a domain.

Quellsprache: Englisch

domain-lookup-entity-chronicle

Use when looking up domain entity graph associations and historical context in Chronicle.

Quellsprache: Englisch

domain-search-dns-chronicle

Use when searching UDM DNS query and resolution logs for a domain in Chronicle.

Quellsprache: Englisch

domain-search-network-traffic-chronicle

Use when querying Chronicle for network connections, HTTP requests, or TLS traffic to a domain.

Quellsprache: Englisch

hash-get-gti-report

Use when querying GTI and VirusTotal reputation and sandbox verdicts for a file hash.

Quellsprache: Englisch

hash-get-secops-threat-intel

Use when retrieving SecOps threat intelligence matches for a SHA256, SHA1, or MD5 hash.

Quellsprache: Englisch

hash-lookup-entity-chronicle

Use when inspecting Chronicle entity records for known malicious or suspicious file hashes.

Quellsprache: Englisch

hash-search-process-events-chronicle

Use when searching Chronicle for process execution events matching a file hash.

Quellsprache: Englisch

ip-get-gti-report

Use when fetching GTI reputation, ASN, and geolocation details for an IP address.

Quellsprache: Englisch

ip-get-secops-threat-intel

Use when querying Chronicle SecOps threat intelligence feeds for an IP address.

Quellsprache: Englisch

ip-lookup-entity-chronicle

Use when examining Chronicle entity graph and asset context for an internal or external IP.

Quellsprache: Englisch

ip-search-network-traffic-chronicle

Use when querying UDM network connection events in Chronicle involving a target IP address.

Quellsprache: Englisch

url-get-gti-report

Use when retrieving GTI threat classification and URL category intelligence.

Quellsprache: Englisch

url-get-secops-threat-intel

Use when querying SecOps threat intelligence indicators for a specific URL.

Quellsprache: Englisch

url-search-chronicle

Use when searching Chronicle proxy and web access logs for HTTP/HTTPS requests to a URL.

Quellsprache: Englisch

user-lookup-entity-chronicle

Use when querying Chronicle user entity details, department, manager, and role context.

Quellsprache: Englisch

user-search-login-activity-chronicle

Use when searching Chronicle authentication events for a user's recent login activity.

Quellsprache: Englisch

user-search-process-activity-chronicle

Use when searching Chronicle endpoint logs for process launches initiated by a specific user.

Quellsprache: Englisch

check-duplicate-cases

Use when checking SOAR cases for overlapping entities to detect duplicate incidents.

Quellsprache: Englisch

close-soar-artifact

Use when setting SOAR alert or case closure status and root cause reason codes.

Quellsprache: Englisch

confirm-action

Use when requesting human operator confirmation before disruptive remediation actions.

Quellsprache: Englisch