Automated Incident Classification Turnkey Playbook

Classify Behavior Analytics incidents into the correct incident type with the Automated Incident Classification turnkey playbook.

When an Advanced Analytics user or asset session becomes notable, Case Manager automatically creates an incident with the Behavior Analytics incident type. The Automated Incident Classification turnkey playbook analyzes session to accurately change the incident's type, helping you make sense of all the evidence in Advanced Analytics and quickly diagnose what threat you're investigating. It's important that incidents have the correct incident type so you standardize the evidence you collect and define tasks for investigating, containing, and remediating the incident.

First, the playbook retrieves the Exabeam Threat Detection, Investigation, and Response (TDIR) Use Case Categories rule tags associated with session's triggered rules. View the output in the workbench, under GET RULE LABELS – EXABEAM AA DEFAULT.

Depending on the rule tag, the playbook adds an incident type.

If the session is associated with any of these rule tags:	The playbook adds this incident type to the incident:
3rd Party Security Alerts Abnormal Application Access Abnormal Authentication & Access Abnormal Database Access Abnormal File Access Abnormal VPN Access Abnormal Web Access Compromised Asset Compromised Service Account Credential Theft	Compromised Credentials
Abnormal Network Connections Abnormal Remote Access Pass the Hash Pass the Ticket	Lateral Movement
Account Switch Bypass Access Controls Discovery DLL Hijacking and Side Loading Permission Changes	Privilege Escalation
Activity on Domain Controllers Disabled Account Activity Executive Account Activity Privileged Account Activity Privileged Asset Activity Privileged Process Execution	Privileged Activity
Abnormal Account Management Activity Abnormal Directory Services Activity Account Creation Activity Account Deletion Activity Membership and Permission Modifications System Account Activity	Account Manipulation
Data Exfiltration Data Exfiltration via DNS Data Exfiltration via Web	Data Exfiltration
Audit Tampering Destruction of File Data Evasion	Evasion
Data Leak Data Leak via Email Data Leak via Printer Data Leak via Removable Device Data Leak via Web	Data Leak
Access to Application Data Access to File Data Database Activity Monitoring	Data Access Abuse
Account Manipulation Disabled Account Abuse Executive Account Abuse Privilege Abuse Privileged Account Abuse Privileged Asset Abuse Service Account Abuse	Privilege Abuse
Audit Log Manipulation	Audit Tampering
Data Deletion	Destruction of Data
Access to Physical Space	Physical Security
Remote Workforce Risk of Attrition Spam	Workforce Protection
Abnormal User Activity	Abnormal Authentication and Access
Brute Force Attack	Brute Force Attack
Cryptomining	Cryptomining
Malware	Malware
Phishing	Phishing
Ransomware	Ransomware

View which incident type was added in the workbench, under MODIFY INCIDENT TYPE – INTERNAL or under the Incident Type incident field.

Cloud-delivered Incident ResponderIncident Responder Documentation

Table of ContentsTable of Contents

Automated Incident Classification Turnkey Playbook