Skip to main content

Incident ResponderIncident Responder Documentation

Version: i56

Phishing Turnkey Playbook

Analyze suspicious emails, detonate malicious email attachments, and change an incident's priority and status with the Phishing turnkey playbook.Turnkey Playbooks

The Phishing turnkey playbook helps you analyze, triage, and respond to suspicious emails, like potential spam and phishing emails. It changes a Case Manager incident's priority based on the reputation of the evidence. It also gathers information about the email recipient from Advanced Analytics and detonates any malicious files in a sandbox.

First, the playbook assesses the reputation of the incident's entities and other evidence, including:

  • Files attached to the email

  • IP addresses

  • Domains of any URLs in the email body

  • Domain of the sender's email address

If the playbook finds any entity with a malicious reputation, it searches for other incidents with the same entity. View the output in the incident's workbench, under IR INCIDENTS WITH IOC. Then, it escalates the incident's priority to Critical. If the playbook doesn't find any entity with a malicious reputation, it changes the incident's priority to Low.

From Advanced Analytics, the playbook retrieves the email recipient's risk score, top device, and other additional contextual information about the recipient. View the output in the incident's workbench, under GET USER RISK SCORES – EXABEAM AA DEFAULT, GET TOP DEVICE FOR USER - EXABEAM AA DEFAULT, and GET USER INFORMATION – EXABEAM AA DEFAULT.

If the playbook finds any files with malicious reputation, it detonates the file in a sandbox.

Keep in mind that you may input only a limited number of files, URLs, or other entities and artifacts to Exabeam Action's Sandbox by Detonate action per day, up to Exabeam's sole discretion. Exabeam throttles your inputs to prevent internal services from overloading and to ensure all Exabeam users can access the action. The exact number of entities and artifacts you can input varies per day.

The Phishing turnkey playbook is similar to the Threat Intelligence Reputation Lookup turnkey playbook, but also includes additional actions for gathering Advanced Analytics data and detonating malicious files. To quickly assess and view the reputation of an incident's entities and artifacts, run the Threat Intelligence Reputation Lookup turnkey playbook instead.