Incident ResponderIncident Responder Documentation

Pre-configured playbooks are ready to run for phishing and malware threats.

We launched turnkey playbooks with the Threat Intelligence Reputation Lookup turnkey playbook. Now, you have turnkey playbooks that address phishing and malware threats.

The Phishing turnkey playbook is an extended version of the existing Threat Intelligence Reputation Lookup turnkey playbook. It similarly analyzes and triages suspicious emails, but also gathers data from Advanced Analytics and detonates files in a sandbox if the email is considered malicious.

The Malware turnkey playbook helps you analyze, triage, and detonate suspicious files that may be potential malware. Depending on the reputation of the file entities and their related hashes, it changes the incident's priority and comments on the incident.

Exabeam Documentation: Phishing Turnkey Playbook

Exabeam Documentation: Malware Turnkey Playbook

Use the Notify by Email Exabeam action to get notified by email about your playbook outputs.

When used in a playbook, the new Notify by Email action sends you an email notifying you about a playbook's outputs. While you can manually run the action on its own, it was designed to be used only as a playbook action node.

When you configure the action, you must select an email template, which determines the email subject line and body. There are two out-of-the-box templates: Phishing email received and Phishing email (benign) received. The Phishing email received email template notifies you that the playbook found a malicious phishing email. The Phishing (benign) received email template notifies you that the playbook found an unsolicited spam email. Modify these templates or create ones that better suit your playbooks.

Exabeam Documentation: Create an Email Template for the Notify by Email Action

Automatically run playbooks under more scenarios with three new playbook triggers.

Previously, you could automatically run playbooks using three triggers: incident created, status changed, and priority changed. We added three more triggers so you can automatically run playbooks under more scenarios: queue changed, assignee changed, and incident type changed.

Exabeam Documentation: Playbook Triggers

Exabeam Documentation: Create a Playbook Trigger