Skip to content

Commit 0a8c534

Browse files
pyth0n1cpyth0n1c
committed
Update playbooks to new format.
1 parent 81bdcbb commit 0a8c534

86 files changed

Lines changed: 1319 additions & 1331 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎playbooks/AD_LDAP_Account_Locking.yml‎

Lines changed: 17 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -1,29 +1,28 @@
11
name: AD LDAP Account Locking
22
id: e6f96caf-610c-4ced-aa2c-ba9b19b89e1f
3-
version: 1
4-
date: '2023-05-08'
3+
version: 2
4+
creation_date: '2023-05-17'
5+
modification_date: '2026-05-19'
56
author: Teoderick Contreras, Splunk
67
type: Investigation
78
description: "Accepts user, to be disabled using Microsoft AD LDAP connector. This playbook produces a normalized observables output for each user and device."
89
playbook: AD_LDAP_Account_Locking
9-
how_to_implement: This input playbook requires the Microsoft AD LDAP connector to be configured.
10-
It is designed to work in conjunction with the Dynamic Attribute Lookup playbook or other playbooks in the same style.
10+
how_to_implement: This input playbook requires the Microsoft AD LDAP connector to be configured. It is designed to work in conjunction with the Dynamic Attribute Lookup playbook or other playbooks in the same style.
1111
references: []
12-
app_list:
13-
- AD LDAP
14-
tags:
15-
platform_tags:
12+
app_list:
13+
- AD LDAP
14+
platform_tags:
1615
- user
1716
- microsoft_ad_ldap
1817
- D3-AL
1918
- disable_account
20-
playbook_type: Input
21-
vpe_type: Modern
22-
playbook_fields: []
23-
product:
24-
- Splunk SOAR
25-
use_cases:
26-
- Phishing
27-
- Endpoint
28-
defend_technique_id:
29-
- D3-AL
19+
playbook_type: Input
20+
vpe_type: Modern
21+
playbook_fields: []
22+
product:
23+
- Splunk SOAR
24+
use_cases:
25+
- Phishing
26+
- Endpoint
27+
defend_technique_id:
28+
- D3-AL

‎playbooks/AD_LDAP_Account_Unlocking.yml‎

Lines changed: 12 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -1,24 +1,24 @@
11
name: AD LDAP Account Unlocking
22
id: e6f96caf-61ac-4ced-aabc-ba9b19bd9e1f
3-
version: 1
4-
date: '2023-06-21'
3+
version: 2
4+
creation_date: '2023-06-22'
5+
modification_date: '2026-05-19'
56
author: Lou Stella, Splunk
67
type: Response
78
description: "Accepts user, to be unlocked using Microsoft AD LDAP connector. This playbook produces a normalized observable output for each user."
89
playbook: AD_LDAP_Account_Unlocking
9-
how_to_implement: This input playbook requires the Microsoft AD LDAP connector to be configured. It is designed to work in conjunction with the Active Directory Enable Account Dispatch playbook or other playbooks in the same style.
10+
how_to_implement: This input playbook requires the Microsoft AD LDAP connector to be configured. It is designed to work in conjunction with the Active Directory Enable Account Dispatch playbook or other playbooks in the same style.
1011
references: []
11-
app_list:
12-
- AD LDAP
13-
tags:
14-
platform_tags:
12+
app_list:
13+
- AD LDAP
14+
platform_tags:
1515
- user
1616
- microsoft_ad_ldap
1717
- D3-RUAA
1818
- active_directory
1919
- enable_account
20-
playbook_type: Input
21-
vpe_type: Modern
22-
playbook_fields: []
23-
product:
24-
- Splunk SOAR
20+
playbook_type: Input
21+
vpe_type: Modern
22+
playbook_fields: []
23+
product:
24+
- Splunk SOAR

‎playbooks/AD_LDAP_Entity_Attribute_Lookup.yml‎

Lines changed: 16 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -1,25 +1,25 @@
11
name: AD LDAP Entity Attribute Lookup
22
id: fc0edc96-aa2b-4cb0-7b4d-63da67d3fe74
3-
version: 1
4-
date: '2023-01-11'
3+
version: 2
4+
creation_date: '2023-03-06'
5+
modification_date: '2026-05-19'
56
author: Kelby Shelton, Lou Stella, Splunk
67
type: Investigation
78
description: "Accepts a user or device and looks up the most recent attributes and groups for that user or device. This playbook produces a normalized output for each user and device."
89
playbook: AD_LDAP_Entity_Attribute_Lookup
9-
how_to_implement: This input playbook requires the AD LDAP connector to be configured. It is designed to work in conjunction with the Dynamic Attribute Lookup playbook or other playbooks in the same style.
10+
how_to_implement: This input playbook requires the AD LDAP connector to be configured. It is designed to work in conjunction with the Dynamic Attribute Lookup playbook or other playbooks in the same style.
1011
references: []
11-
app_list:
12-
- AD LDAP
13-
tags:
14-
platform_tags:
15-
- attributes
12+
app_list:
13+
- AD LDAP
14+
platform_tags:
15+
- attributes
1616
- user
17-
- device
17+
- device
1818
- ad_ldap
19-
playbook_type: Input
20-
vpe_type: Modern
21-
playbook_fields: []
22-
product:
23-
- Splunk SOAR
24-
use_cases:
25-
- Enrichment
19+
playbook_type: Input
20+
vpe_type: Modern
21+
playbook_fields: []
22+
product:
23+
- Splunk SOAR
24+
use_cases:
25+
- Enrichment

‎playbooks/AWS_IAM_Account_Locking.yml‎

Lines changed: 17 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -1,29 +1,28 @@
11
name: AWS IAM Account Locking
22
id: f15e4ab7-b057-4225-86ae-c36ab78b50f2
3-
version: 1
4-
date: '2023-05-08'
3+
version: 2
4+
creation_date: '2023-05-10'
5+
modification_date: '2026-05-19'
56
author: Teoderick Contreras, Splunk
67
type: Investigation
78
description: "Accepts user name that needs to be disabled in AWS IAM Active Directory. Disabling an account involves deleting their login profile which will clear the user's password. Generates an observable output based on the status of account locking or disabling."
89
playbook: AWS_IAM_Account_Locking
9-
how_to_implement: This input playbook requires the AWS IAM connector to be configured.
10-
It is designed to work in conjunction with the Dynamic Attribute Lookup playbook or other playbooks in the same style.
10+
how_to_implement: This input playbook requires the AWS IAM connector to be configured. It is designed to work in conjunction with the Dynamic Attribute Lookup playbook or other playbooks in the same style.
1111
references: []
12-
app_list:
13-
- AWS IAM
14-
tags:
15-
platform_tags:
12+
app_list:
13+
- AWS IAM
14+
platform_tags:
1615
- user
1716
- aws_iam
1817
- D3-AL
1918
- disable_account
20-
playbook_type: Input
21-
vpe_type: Modern
22-
playbook_fields: []
23-
product:
24-
- Splunk SOAR
25-
use_cases:
26-
- Phishing
27-
- Endpoint
28-
defend_technique_id:
29-
- D3-AL
19+
playbook_type: Input
20+
vpe_type: Modern
21+
playbook_fields: []
22+
product:
23+
- Splunk SOAR
24+
use_cases:
25+
- Phishing
26+
- Endpoint
27+
defend_technique_id:
28+
- D3-AL

‎playbooks/AWS_IAM_Account_Unlocking.yml‎

Lines changed: 14 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -1,25 +1,25 @@
11
name: AWS IAM Account Unlocking
22
id: f15a4db3-b157-4225-86ae-c36ab78b50f2
3-
version: 1
4-
date: '2023-06-21'
3+
version: 2
4+
creation_date: '2023-06-22'
5+
modification_date: '2026-05-19'
56
author: Lou Stella, Splunk
67
type: Response
78
description: "Accepts user, to be enabled using AWS IAM connector. Enabling an account involves reattaching their login profile which will require setting a new password. This playbook produces a normalized observables output for each user. "
89
playbook: AWS_IAM_Account_Unlocking
9-
how_to_implement: This input playbook requires the AWS IAM connector to be configured.
10+
how_to_implement: This input playbook requires the AWS IAM connector to be configured.
1011
references: []
11-
app_list:
12-
- AWS IAM
13-
tags:
14-
platform_tags:
12+
app_list:
13+
- AWS IAM
14+
platform_tags:
1515
- user
1616
- aws_iam
1717
- D3-RUAA
1818
- enable_account
19-
playbook_type: Input
20-
vpe_type: Modern
21-
playbook_fields: []
22-
product:
23-
- Splunk SOAR
24-
defend_technique_id:
25-
- D3-RUAA
19+
playbook_type: Input
20+
vpe_type: Modern
21+
playbook_fields: []
22+
product:
23+
- Splunk SOAR
24+
defend_technique_id:
25+
- D3-RUAA

‎playbooks/Active_Directory_Disable_Account_Dispatch.yml‎

Lines changed: 18 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -1,29 +1,28 @@
11
name: Active Directory Disable Account Dispatch
22
id: 86320591-1bbd-41ab-8990-602a3968fd99
3-
version: 1
4-
date: '2023-05-23'
3+
version: 2
4+
creation_date: '2023-05-23'
5+
modification_date: '2026-05-19'
56
author: Teoderick Contreras, Splunk
67
type: Investigation
7-
description: Automatically dispatches input playbooks with the 'disable_account' tag.
8-
This will produce a merge report and indicator tag for each inputs.
8+
description: Automatically dispatches input playbooks with the 'disable_account' tag. This will produce a merge report and indicator tag for each inputs.
99
playbook: Active_Directory_Disable_Account_Dispatch
1010
how_to_implement: This automatic playbook requires "disable_account" tag be present on each input playbook you want to launch.
1111
references: []
12-
app_list:
13-
- AD LDAP
14-
- Azure AD Graph
15-
tags:
16-
platform_tags:
12+
app_list:
13+
- AD LDAP
14+
- Azure AD Graph
15+
platform_tags:
1716
- user
1817
- D3-AL
1918
- disable_account
20-
playbook_type: Automation
21-
vpe_type: Modern
22-
playbook_fields: []
23-
product:
24-
- Splunk SOAR
25-
use_cases:
26-
- Phishing
27-
- Endpoint
28-
defend_technique_id:
29-
- D3-AL
19+
playbook_type: Automation
20+
vpe_type: Modern
21+
playbook_fields: []
22+
product:
23+
- Splunk SOAR
24+
use_cases:
25+
- Phishing
26+
- Endpoint
27+
defend_technique_id:
28+
- D3-AL

‎playbooks/Active_Directory_Enable_Account_Dispatch.yml‎

Lines changed: 13 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -1,25 +1,25 @@
11
name: Active Directory Enable Account Dispatch
22
id: 86320a91-1bde-41ab-8990-602a3768fd99
3-
version: 1
4-
date: '2023-05-23'
3+
version: 2
4+
creation_date: '2023-06-22'
5+
modification_date: '2026-05-19'
56
author: Lou Stella, Splunk
67
type: Response
78
description: Automatically dispatches input playbooks with the 'enable_account' tag. This will produce a merge report and indicator tag for each inputs.
89
playbook: Active_Directory_Enable_Account_Dispatch
910
how_to_implement: This automatic playbook requires the "enable_account" tag be present on each input playbook you want to launch.
1011
references: []
11-
app_list:
12-
- AD LDAP
13-
- Azure AD Graph
14-
- AWS IAM
15-
tags:
16-
platform_tags:
12+
app_list:
13+
- AD LDAP
14+
- Azure AD Graph
15+
- AWS IAM
16+
platform_tags:
1717
- user
1818
- D3-RUAA
1919
- enable_account
2020
- active_directory
21-
playbook_type: Automation
22-
vpe_type: Modern
23-
playbook_fields: []
24-
product:
25-
- Splunk SOAR
21+
playbook_type: Automation
22+
vpe_type: Modern
23+
playbook_fields: []
24+
product:
25+
- Splunk SOAR

‎playbooks/Attribute_Lookup_Dispatch.yml‎

Lines changed: 12 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -1,20 +1,20 @@
11
name: Attribute Lookup Dispatch
22
id: fc0edc96-ff2b-68d0-9a4d-63da6783fd64
3-
version: 1
4-
date: '2023-03-06'
3+
version: 2
4+
creation_date: '2023-03-06'
5+
modification_date: '2026-05-19'
56
author: Lou Stella, Splunk
67
type: Investigation
78
description: "Detects available entities and routes them to attribute lookup playbooks. The output of the playbooks will create new artifacts for any technologies that returned information."
89
playbook: Attribute_Lookup_Dispatch
9-
how_to_implement: This playbook looks for artifacts and then dispatches the community Attribute Lookup playbooks. This playbook takes the output of those playbooks and nicely formats them into new artifacts with their results.
10+
how_to_implement: This playbook looks for artifacts and then dispatches the community Attribute Lookup playbooks. This playbook takes the output of those playbooks and nicely formats them into new artifacts with their results.
1011
references: []
1112
app_list: []
12-
tags:
13-
platform_tags: []
14-
playbook_type: Automation
15-
vpe_type: Modern
16-
playbook_fields: []
17-
product:
18-
- Splunk SOAR
19-
use_cases:
20-
- Enrichment
13+
platform_tags: []
14+
playbook_type: Automation
15+
vpe_type: Modern
16+
playbook_fields: []
17+
product:
18+
- Splunk SOAR
19+
use_cases:
20+
- Enrichment

‎playbooks/Automated_Enrichment.yml‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,19 @@
11
name: Automated Enrichment
22
id: fc0edc96-ff1b-65e0-9a4d-64da6783fd64
3-
version: 2
4-
date: '2023-03-06'
3+
version: 3
4+
creation_date: '2023-03-06'
5+
modification_date: '2026-05-19'
56
author: Kelby Shelton, Patrick Bareiss, Teoderick Contreras, Lou Stella Splunk
67
type: Investigation
78
description: "Moves the event status to open and then launches the Dispatch playbooks for Reputation Analysis, Attribute Lookup, and Related Tickets."
89
playbook: Automated_Enrichment
910
how_to_implement: 1. Ensure you have a reputation analysis playbook (e.g. VirusTotal v3), an attribute lookup playbook (e.g. Azure AD), and a related ticket search playbook (e.g. ServiceNow).\n2. Download local versions of Identifier Reputation Analysis Dispatch, Attribute Lookup Dispatch, and Related Tickets Search Dispatch playbooks.
1011
references: []
1112
app_list: []
12-
tags:
13-
platform_tags:
13+
platform_tags:
1414
- Enrichment
15-
playbook_type: Automation
16-
vpe_type: Modern
17-
playbook_fields: []
18-
product:
19-
- Splunk SOAR
15+
playbook_type: Automation
16+
vpe_type: Modern
17+
playbook_fields: []
18+
product:
19+
- Splunk SOAR

0 commit comments

Comments
 (0)