dandye/adk_runbooks

detection-engineering-coverage-evaluation

Use when evaluating threat detection opportunities (TDOs), generating synthetic UDM events, evaluating Chronicle rule coverage, and drafting YARA-L 2.0 rules.

Idioma del texto original: inglés

apt-threat-hunt

Use when hunting for advanced persistent threat (APT) actor activity, tools, and infrastructure.

Idioma del texto original: inglés

lateral-movement-hunt-psexec-wmi

Use when hunting for lateral movement via PsExec, WMI, remote scheduled tasks, or WinRM.

Idioma del texto original: inglés

proactive-hunt-gti-campaign

Use when initiating threat hunting operations driven by GTI threat campaign intelligence.

Idioma del texto original: inglés

basic-ioc-enrichment

Use when conducting initial reputation and threat intelligence lookups on suspicious observables.

Idioma del texto original: inglés

deep-dive-ioc-analysis

Use when performing exhaustive forensic and intelligence analysis on complex indicators of compromise.

Idioma del texto original: inglés

investigate-case-external-tools

Use when enriching and verifying case artifacts with external threat intelligence platforms.

Idioma del texto original: inglés

ioc-containment

Use when executing network, host, or credential containment actions for validated malicious IOCs.

Idioma del texto original: inglés

prioritize-and-investigate-case

Use when scoring case urgency, prioritizing the queue, and running core investigations.

Idioma del texto original: inglés

compromised-user-account-response

Use when executing containment, eradication, and recovery for confirmed compromised user credentials.

Idioma del texto original: inglés

malware-incident-response

Use when coordinating response and remediation for advanced malware infections.

Idioma del texto original: inglés

phishing-response

Use when responding to reported phishing emails, malicious links, or credential harvesting campaigns.

Idioma del texto original: inglés

ransomware-response

Use when responding to active ransomware deployment, host encryption, or extortion threats.

Idioma del texto original: inglés

create-investigation-report

Use when compiling comprehensive incident investigation findings and executive summaries.

Idioma del texto original: inglés

cloud-vulnerability-triage

Use when triaging cloud security posture vulnerabilities and contextualizing finding risk.

Idioma del texto original: inglés

malware-triage

Use when analyzing malware detection alerts, isolating infected endpoints, and scoping file executions.

Idioma del texto original: inglés

suspicious-login-triage

Use when triaging anomalous or suspicious user authentication events, impossible travel, and credential anomalies.

Idioma del texto original: inglés

triage-alerts

Use when evaluating and categorizing incoming security alerts to determine severity and initial response actions.

Idioma del texto original: inglés

domain-get-gti-report

Use when fetching GTI threat reputation and WHOIS intelligence for a specific domain name.

Idioma del texto original: inglés

domain-get-secops-threat-intel

Use when retrieving Chronicle SecOps threat intelligence and IOC matches for a domain.

Idioma del texto original: inglés

domain-lookup-entity-chronicle

Use when looking up domain entity graph associations and historical context in Chronicle.

Idioma del texto original: inglés

domain-search-dns-chronicle

Use when searching UDM DNS query and resolution logs for a domain in Chronicle.

Idioma del texto original: inglés

domain-search-network-traffic-chronicle

Use when querying Chronicle for network connections, HTTP requests, or TLS traffic to a domain.

Idioma del texto original: inglés

hash-get-gti-report

Use when querying GTI and VirusTotal reputation and sandbox verdicts for a file hash.

Idioma del texto original: inglés

hash-get-secops-threat-intel

Use when retrieving SecOps threat intelligence matches for a SHA256, SHA1, or MD5 hash.

Idioma del texto original: inglés

hash-lookup-entity-chronicle

Use when inspecting Chronicle entity records for known malicious or suspicious file hashes.

Idioma del texto original: inglés

hash-search-process-events-chronicle

Use when searching Chronicle for process execution events matching a file hash.

Idioma del texto original: inglés

ip-get-gti-report

Use when fetching GTI reputation, ASN, and geolocation details for an IP address.

Idioma del texto original: inglés

ip-get-secops-threat-intel

Use when querying Chronicle SecOps threat intelligence feeds for an IP address.

Idioma del texto original: inglés

ip-lookup-entity-chronicle

Use when examining Chronicle entity graph and asset context for an internal or external IP.

Idioma del texto original: inglés

ip-search-network-traffic-chronicle

Use when querying UDM network connection events in Chronicle involving a target IP address.

Idioma del texto original: inglés

url-get-gti-report

Use when retrieving GTI threat classification and URL category intelligence.

Idioma del texto original: inglés

url-get-secops-threat-intel

Use when querying SecOps threat intelligence indicators for a specific URL.

Idioma del texto original: inglés

url-search-chronicle

Use when searching Chronicle proxy and web access logs for HTTP/HTTPS requests to a URL.

Idioma del texto original: inglés

user-lookup-entity-chronicle

Use when querying Chronicle user entity details, department, manager, and role context.

Idioma del texto original: inglés

user-search-login-activity-chronicle

Use when searching Chronicle authentication events for a user's recent login activity.

Idioma del texto original: inglés

user-search-process-activity-chronicle

Use when searching Chronicle endpoint logs for process launches initiated by a specific user.

Idioma del texto original: inglés

check-duplicate-cases

Use when checking SOAR cases for overlapping entities to detect duplicate incidents.

Idioma del texto original: inglés

close-soar-artifact

Use when setting SOAR alert or case closure status and root cause reason codes.

Idioma del texto original: inglés

confirm-action

Use when requesting human operator confirmation before disruptive remediation actions.

Idioma del texto original: inglés