Create Lookup Request for IoC Changes workflow

The Security Incident Response - Create Lookup Request for IoC Changes flow is triggered by a business rule to run automatically when an IoC is added or changed. Malware scans are triggered only when new data is entered and only the new data is scanned.

始める前に

Role required: sn_si.basic

このタスクについて

If the IoC is empty, the workflow does not run. Historical scans are retained and viewable in the Security Scan Requests tab and worknotes of the security incident. The existing security incidents are automatically updated.

重要:

The Security Incident Response - Create Lookup Request for IoC Changes workflow is migrated to the Flow Designer. The flow gets triggered only when the sn_ti_scanner has at least one record.

The Flow Designer actions include:

• Audit Log Enrichment
• Create IoC Lookup Request activity

図 : 1. IoC Changes workflow

• Create IoC Lookup Request activity
  The Create IoC Lookup Request activity can be used with any workflow to create a malware lookup request for added or modified IoC fields.

関連概念

• Run procdump flow

関連タスク

• Security Incident Response- Get Network Statistics flow
• Security Incident Response - Get Running Services workflow
• Security Incident - Evaluate response task outcome workflow