Playbook
The Incident Responder Playbook feature is used to create rules that automate the analysis and incident response to suspicious emails, which saves valuable time.
The Playbook rules will work only if the reported email matches the condition in the rules.
Defining a Playbook Rule
From the sidebar on the left side of the dashboard, select Incident Responder. Select Playbook and click + NEW to create a new rule with the criteria below.
Rule Name* | Name of the playbook rule |
Description | More information/detailed description of the playbook rule |
Priority | Priority level of the playbook rule |
Tags | Tags related to the playbook rule |
Active | Status of the playbook rule: active or passive |
The fields marked with (*) are required.
Click Next to set the conditions for use.
Condition Criteria
The following parameters can be used to define reported emails:
From | Sender email address |
To | Recipient email address |
CC | Copied recipient email address |
Sender IP | Sender IP address or Sender IP as a Regex pattern |
Subject | Subject line of the email |
Keyword | Specific words used in the email body |
Attachment name | Name of the email attachment |
Attachment hash | Hash (SHA512 or MD5) value of the e-mail attachment |
Attachment extension | File extension of the e-mail attachment, e.g., .pdf, .docx |
Condition Types
The conditions can be defined using the following parameters:
contains | Contains the specified condition criterion |
does not contain | Doesn’t contain the specified condition criterion |
is equal to | Specified condition criteria match exactly |
is not equal to | Specified condition criterion does not match exactly |
exists | Specified condition criterion exists |
does not exist | Specified condition criterion does not exist |
Actions
The following actions can be applied when a reported e-mail meets the criteria defined in a playbook rule:
Mark as | Mark the reported email as undetected, phishing, malicious, or simulation. |
Analyze | Analyze the reported email with defined integrations. |
Analyze > Investigate according to analyze results | Start an automatic investigation based on the analysis results. If the analysis results are phishing or malicious, an investigation will be started based on the configuration. |
Investigate | Launch an investigation. Learn more about investigations here. |
Notify | User(s) are notified via email. The notification email template can be customized and the recipient(s) can be designated here. |
Notify According To Analysis Result | User(s) are notified via email when the reported email's analysis result matches the selected results. |
Status | Case status is updated as Closed, In progress, Open, or False positive. |
Tag | Tag used for matching results in the investigations. |
Update Conditions or Settings of a Playbook Rule
To change a playbook rule, select Incident Responder > Playbook page from the left sidebar menu of the dashboard. All of the existing rules will be displayed. Select the rule(s) to be updated and click on the pencil (edit) icon under the Action column to update details of a playbook rule.
Delete a Playbook Rule
To delete a playbook rule, select Incident Responder > Playbook page from the left sidebar menu of the dashboard. All of the existing rules will be displayed. Select the rule(s) to be deleted and remove them using the trash can icon.
FAQ
Q: Will deleting a playbook rule affect the results of previous investigations?
A: No. Earlier playbook results using the rule will not be affected.
Q: Will creating a new playbook rule affect the results of previous investigations?
A: No. A new playbook rule will only affect future investigations.
Q: If I edit an existing playbook rule, does it change the rules for current investigations?
A: No. There will be no changes to existing investigations. When you edit a rule, it will only affect future investigations where the rule applies.
Q: If I set playbook rules that are similar or contradictory, which will have priority or be valid?
A: The priority and criteria assigned when setting the rule govern the actions taken.
Q: How can I edit or update the notification email templates used with the Notify action?
A: You can go to Company > Company Settings > Notification Templates to view and update the template library. You can find additional information here.
Last updated