Skip to main content

Cloud-delivered Incident ResponderIncident Responder Documentation

Automated Incident Enrichment Turnkey Playbook

Gather evidence from an Advanced Analytics session and add them to the corresponding Case Manager incident with the Automated Incident Enrichment turnkey playbook.

When an Advanced Analytics Smart Timeline™ user or asset session becomes notable, Case Manager automatically creates an incident with the Behavior Analytics incident type. The Automated Incident Enrichment turnkey playbook gathers additional contextual or supporting information from the Advanced Analytics session and populates the Case Manager incident so you have everything you need to investigate the incident.

First, the playbook returns the session's anomalous activity, and gathers evidence to add to the Case Manager incident:

  • The playbook returns the MITRE ATT&CK® tactics and techniques rule tags associated with the session. View the output in the workbench under GET RULE LABELS – EXABEAM AA DEFAULT.

  • The playbook gathers all the rules triggered during the notable session and other related details, like the rule description, rule category, and associated model name. View the output in the workbench under GET TRIGGERED RULES – EXABEAM AA DEFAULT.

  • The playbook gathers other relevant evidence about the event, including event type, event ID, raw log time, and details about any processes, files, domains, hosts, URLs, or email addresses involved. View the output in the workbench under GET EVENT INFO – EXABEAM AA DEFAULT.

    Then, it adds this evidence to the incident in incident fields, or as entities or artifacts. For example, it adds the destination IP to the incident as an IP artifact. In the workbench, view the information and whether an entity or artifact was created under ADD TO INCIDENT – INTERNAL.

If the incident involves a notable user, the playbook returns the user's past anomalous behavior, including their risk score for every session in the past 14 days and all the rules triggered in the user's sessions in the past 14 days. Then, it collects any additional contextual information about the user and searches for other Case Manager incidents involving the user. View the output in the workbench, including:

  • Risk score for each session in the past 14 days, under GET USER RISK SCORE – EXABEAM AA DEFAULT.

  • All rules triggered in the user's sessions in the past 14 days, under GET TRIGGERED RULES – EXABEAM AA DEFAULT.

  • Additional contextual information about the user, under GET USER INFORMATION – EXABEAM AA DEFAULT.

  • Other Case Manager incidents involving the notable user in the past 14 days, under SEARCH IR INCIDENTS WITH IOC.

If the incident involves a notable asset, the playbook returns the asset's past anomalous behavior, including their risk score for every session in the past 14 days and all the rules triggered in the asset's sessions in the past 14 days. Then, it collects any additional contextual information about the asset and searches for other Case Manager incidents involving the asset. View the output in the workbench, including:

  • Risk score for each session in the past 14 days, under GET ASSET RISK SCORE – EXABEAM AA DEFAULT

  • All rules triggered in the asset's sessions in the past 14 days, under GET ASSET TRIGGERED RULES – EXABEAM AA DEFAULT.

  • Additional contextual information about the asset, under GET ASSET INFORMATION – EXABEAM AA DEFAULT.

  • Other Case Manager incidents involving the same notable asset in the past 14 days, under SEARCH IR INCIDENTS WITH IOC.