Playbook
The Incident Responder Playbook feature is used to create rules that automate the analysis and incident response to suspicious emails, which saves valuable time.
The Playbook rules will work only if the reported email matches the condition in the rules.
Defining a Playbook Rule
From the sidebar on the left side of the dashboard, select Incident Responder. Select Playbook and click + NEW to create a new rule with the criteria below.
Rule Name*
Name of the playbook rule
Description
More information/detailed description of the playbook rule
Priority
Priority level of the playbook rule
Tags
Tags related to the playbook rule
Active
Status of the playbook rule: active or passive
The fields marked with (*) are required.
Click Next to set the conditions for use.
Condition Criteria
The following parameters can be used to define reported emails:
From
Sender email address
To
Recipient email address
CC
Copied recipient email address
Sender IP
Sender IP address or Sender IP as a Regex pattern
Subject
Subject line of the email
Keyword
Specific words used in the email body
Attachment name
Name of the email attachment
Attachment hash
Hash (SHA512 or MD5) value of the e-mail attachment
Attachment extension
File extension of the e-mail attachment, e.g., .pdf, .docx
Condition Types
The conditions can be defined using the following parameters:
contains
Contains the specified condition criterion
does not contain
Doesn’t contain the specified condition criterion
is equal to
Specified condition criteria match exactly
is not equal to
Specified condition criterion does not match exactly
exists
Specified condition criterion exists
does not exist
Specified condition criterion does not exist
Actions
The following actions can be applied when a reported e-mail meets the criteria defined in a playbook rule:
Mark as
Mark the reported email as undetected, phishing, malicious, or simulation.
Analyze
Analyze the reported email with defined integrations.
Analyze > Investigate according to analyze results
Start an automatic investigation based on the analysis results. If the analysis results are phishing or malicious, an investigation will be started based on the configuration.
Investigate
Notify
Notify According To Analysis Result
User(s) are notified via email when the reported email's analysis result matches the selected results.
Status
Case status is updated as Closed, In progress, Open, or False positive.
Tag
Tag used for matching results in the investigations.
Update Conditions or Settings of a Playbook Rule
To change a playbook rule, select Incident Responder > Playbook page from the left sidebar menu of the dashboard. All of the existing rules will be displayed. Select the rule(s) to be updated and click on the pencil (edit) icon under the Action column to update details of a playbook rule.
Delete a Playbook Rule
To delete a playbook rule, select Incident Responder > Playbook page from the left sidebar menu of the dashboard. All of the existing rules will be displayed. Select the rule(s) to be deleted and remove them using the trash can icon.
FAQ
Q: Will deleting a playbook rule affect the results of previous investigations?
A: No. Earlier playbook results using the rule will not be affected.
Q: Will creating a new playbook rule affect the results of previous investigations?
A: No. A new playbook rule will only affect future investigations.
Q: If I edit an existing playbook rule, does it change the rules for current investigations?
A: No. There will be no changes to existing investigations. When you edit a rule, it will only affect future investigations where the rule applies.
Q: If I set playbook rules that are similar or contradictory, which will have priority or be valid?
A: The priority and criteria assigned when setting the rule govern the actions taken.
Q: How can I edit or update the notification email templates used with the Notify action?
Last updated
Was this helpful?