Set up the Email Spoof Detection playbook

  • Release version: Yokohama
  • Updated January 30, 2025
  • 1 minute to read

    • Use the following steps to set up the Email Spoof Detection playbook.

    Before you begin

    Role required:
    • sn_si.admin
    • flow_designer

    Make sure you have installed Security Operations Spoke (sn_sec_spoke).

    Procedure

    1. Login as a user with sn_si.user and flow_designer roles.
    2. Navigate to All > Flow Designer and select the Email Domain Spoofing Detection playbook playbook.
    3. Optional: You can create a copy of the Email Domain Spoofing Detection playbook flow and make the necessary modifications.
      To create a copy of the playbook's flow, click the More actions menu icon and select Copy flow. Perform this step only if you plan to customize or make specific changes to the flow.
      Figure 1. Email Domain Spoofing Detection playbook
      Overview of the Email Domain Spoofing Detection playbook
    4. Activate the playbooks.
      • Activate the main flow to use the playbook available in the base system.
      • Activate the copied flows after making the required changes.
    5. Set a Trigger Condition for the playbook.
      This playbook is triggered and associated with the security incident when the following conditions are met:
      • From is not empty.
      • Security incident is not empty.

      Trigger condition for Email Domain Spoofing Detection playbook.