diff --git a/response_templates/GenericIncidentResponse_v4.json b/response_templates/GenericIncidentResponse_v4.json
index b2368751a9..4d0deb9172 100644
--- a/response_templates/GenericIncidentResponse_v4.json
+++ b/response_templates/GenericIncidentResponse_v4.json
@@ -1 +1 @@
-{"id": "bd873ed6-1463-4fbf-a184-8cc3ad7c446c", "create_time": 1788276134.3671353, "update_time": 1788280100.5796342, "name": "Generic Incident Response", "description": "Use%20this%20as%20a%20starting%20point.%20This%20will%20guide%20you%20to%20visualizations%20and%20dashboards%20within%20Splunk%20Enterprise%20Security%20that%20you%20would%20use%20to%20research%20and%20interrogate%20different%20data%20types%20like%20Authentication,%20Endpoint%20or%20Network.%20%20The%20Suggested%20Integrations(connectors)%20are%20just%20that,%20either%20built%20into%20Splunk%20SOAR%20or%20commonly%20used%20by%20customers.%20The%20Actions%20included%20will%20need%20to%20be%20reviewed,%20removed,%20validated,%20or%20added%20based%20on%20what%20tools%20your%20organizations%20use.%20%20Before%20implementing%20be%20sure%20to%20add%20roles%20and%20approvals%20to%20ensure%20proper%20review%20occurs%20in%20the%20incident%20response%20workflow%20", "template_status": "draft", "creator": "splunker", "updated_by": "splunker", "is_default": false, "version": 4, "phases": [{"id": "c8c1bb29-a14c-4230-ba02-283f98645b90", "create_time": 1788276680.0027182, "update_time": 1788280100.5278718, "name": "Initial%20Reporting%20and%20Awareness%20", "order": 1, "tasks": [{"id": "76fd8383-b2f7-47d8-b952-49a60105c23f", "create_time": 1764758755.9055116, "update_time": 1788280100.527043, "name": "Ensure%20Investigations%20are%20mirrored%20in%20the%20core%20enterprise%20tracking%20system.", "order": 1, "tag": "69c9baf1-bd12-4b09-b6b6-a77df9428682", "description": "Open%20Incident%20to%20track%0A%0ASuggested%20Integration%20(if%20not%20already%20configured%20navigate%20%5BHERE%5D(/app/SplunkEnterpriseSecuritySuite/ess_configuration/#/soar/soar_apps/apps)%20to%20locate%20and%20configure)%0A%0A-%20Service%20Now%20%0A-%20Salesforce%20%0A-%20Jira", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [{"id": "3ff21177-da2b-4c47-acc7-b44d4dd0dc2a", "create_time": 1788276603.7561357, "update_time": 1788280100.5271513, "last_job_id": 0, "name": "create ticket - ServiceNow", "action": "2471", "description": "Create a new ticket/record", "type": "create ticket", "app_id": 147, "asset": 29, "parameters": [{"table": "", "fields": "", "vault_id": "", "description": "", "short_description": ""}]}, {"id": "71f70831-5652-41d8-a05e-6d4c7221b81d", "create_time": 1788276680.0023613, "update_time": 1788280100.5271919, "last_job_id": 0, "name": "create ticket - Salesforce", "action": "2933", "description": "Create a new Case", "type": "create ticket", "app_id": 144, "asset": 34, "parameters": [{"subject": "", "priority": "", "description": "", "field_values": "", "parent_case_id": ""}]}, {"id": "45052d6d-ffd0-4491-9434-af7c69b6544d", "create_time": 1788276680.0023906, "update_time": 1788280100.5272317, "last_job_id": 0, "name": "create ticket - Jira", "action": "2285", "description": "Create a ticket (issue)", "type": "create ticket", "app_id": 80, "asset": 31, "parameters": [{"fields": "", "summary": "", "assignee": "", "priority": "", "vault_id": "", "issue_type": "", "description": "", "project_key": "", "assignee_account_id": ""}]}], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}, {"id": "c62f8956-c622-4c11-a664-9d68661f2df1", "create_time": 1764758755.905616, "update_time": 1788280100.5275803, "name": "Alert%20Appropriate%20Parties%20that%20Incident%20Response%20Is%20Starting", "order": 2, "tag": "8ca56a2a-f0d7-43c1-96e3-06bac95deffe", "description": "Send%20Email%20or%20Instant%20message%20to%20appropriate%20teams%20for%20awareness%20and%20assistance%0A%0A%0A%0A%0ASuggested%20Integration%20(if%20not%20already%20configured%20navigate%20%5BHERE%5D(/app/SplunkEnterpriseSecuritySuite/ess_configuration/#/soar/soar_apps/apps)%20to%20locate%20and%20configure)%0A%0A-%20Smtp%20%0A-%20MS%20Graph%20for%20Office%20365%20%0A-%20G%20Suite%20for%20Gmail%20%0A-%20Cisco%20Webex%20%0A-%20Slack%20%0A-%20Microsoft%20Teams", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [{"id": "b7f1588d-09e9-4fe8-b72a-27c599eb2a8d", "create_time": 1788277531.9986718, "update_time": 1788280100.527657, "last_job_id": 0, "name": "send email - SMTP", "action": "1903", "description": "Sends an email", "type": "send email", "app_id": 139, "asset": 6, "parameters": [{"cc": "", "to": "", "bcc": "", "body": "", "from": "", "headers": "", "subject": "", "attachments": ""}]}, {"id": "70c65ce6-06b9-4fbc-9f9b-362f2f4a4817", "create_time": 1788277531.9986978, "update_time": 1788280100.5276885, "last_job_id": 0, "name": "send email - MS Graph for Office 365", "action": "2339", "description": "Sends an email with optional text rendering. Attachments are allowed a Content-ID tag for reference within the html", "type": "send email", "app_id": 97, "asset": 32, "parameters": [{"cc": "", "to": "", "bcc": "", "body": "", "from": "", "headers": "", "subject": "", "attachments": ""}]}, {"id": "24d8b79b-e9a5-43a3-a971-fcbf1d4f02d7", "create_time": 1788277531.998722, "update_time": 1788280100.5277174, "last_job_id": 0, "name": "send email - G Suite for GMail", "action": "2952", "description": "Send email via Gmail.\n\nConstructs MIME message with attachments, respecting 25MB size limit.\nOptionally creates send-as alias before sending.", "type": "send email", "app_id": 88, "asset": 35, "parameters": [{"cc": "", "to": "", "bcc": "", "body": "", "from": "", "headers": "", "subject": "", "reply_to": "", "alias_name": "", "alias_email": "", "attachments": ""}]}, {"id": "4ff61fec-6cb7-4dd8-9b63-ca3ea2e1a18d", "create_time": 1788277531.9987452, "update_time": 1788280100.5277452, "last_job_id": 0, "name": "send message - Cisco Webex", "action": "2960", "description": "Send message to user or room", "type": "send message", "app_id": 42, "asset": 36, "parameters": [{"card": "", "message": "", "vault_id": "", "endpoint_id": "", "is_markdown": false, "destination_type": ""}]}, {"id": "5b82f7e8-0e65-46e0-916c-d0c487e5b65a", "create_time": 1788277531.9987676, "update_time": 1788280100.5277727, "last_job_id": 0, "name": "send message - Slack", "action": "2498", "description": "Send a message to Slack", "type": "send message", "app_id": 152, "asset": 17, "parameters": [{"blocks": "", "message": "", "link_names": false, "destination": "", "reply_broadcast": false, "parent_message_ts": ""}]}, {"id": "8af7ff80-2510-4ec6-aa55-d88d3406b5f8", "create_time": 1788277531.9987895, "update_time": 1788280100.5278, "last_job_id": 0, "name": "send chat message - Microsoft Teams", "action": "2979", "description": "Send a message to specific chat", "type": "send chat message", "app_id": 125, "asset": 37, "parameters": [{"chat_id": "", "message": ""}]}], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}]}, {"id": "816cf263-fcdd-45d6-8f5f-f4c5c3f638bd", "create_time": 1788276680.0036306, "update_time": 1788280100.528886, "name": "Analysis", "order": 2, "tasks": [{"id": "2444a355-821e-4485-86c5-03c836cba7c5", "create_time": 1764758755.9059348, "update_time": 1788280100.5279753, "name": "Research intelligence resources", "order": 1, "tag": "595d75bb-316e-4dec-bfc6-6729d3e7b280", "description": "Review%20Intelligence%20resources%20including%20Splunk%20Attack%20Analyzer%20and%20Cisco%20Talos%20in%20the%20Intelligence%20Tab%20of%20investigation%0A%0ASuggested%20Integration%20(%20if%20not%20already%20configured%20navigate%20%5BHERE%5D(/app/SplunkEnterpriseSecuritySuite/ess_configuration/#/soar/soar_apps/apps)%20to%20locate%20and%20configure)%0A1.%20Splunk%20Attack%20Analyzer%0A2.%20Cisco%20Talos%20Intelligence%0A3.%20VirusTotal%20v3%0A4.%20PhishTank%20(preconfigured)", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [{"id": "0d079a95-c063-4b33-87ba-25fe661a9ece", "create_time": 1774295034.6502967, "update_time": 1788280100.5280461, "last_job_id": 0, "name": "detonate file - Splunk Attack Analyzer Connector for Splunk SOAR", "action": "8939", "description": "Submit File for Scanning", "type": "detonate file", "app_id": 283, "asset": 23, "parameters": [{"file": "", "ph_0": "", "profile": "", "user_agent": "", "internet_region": "", "archive_password": "", "custom_user_agent": ""}]}, {"id": "efe8365d-975e-4aa6-a26e-6eeca46a39e4", "create_time": 1774295034.650387, "update_time": 1788280100.5280788, "last_job_id": 0, "name": "detonate url - Splunk Attack Analyzer Connector for Splunk SOAR", "action": "8940", "description": "Submit New URL for Scanning", "type": "detonate url", "app_id": 283, "asset": 23, "parameters": [{"url": "", "ph_0": "", "profile": "", "user_agent": "", "internet_region": "", "archive_password": "", "custom_user_agent": ""}]}, {"id": "60f5815d-8d11-490d-870c-3e174acc2cdd", "create_time": 1774295034.650461, "update_time": 1788280100.5281093, "last_job_id": 0, "name": "get job summary - Splunk Attack Analyzer Connector for Splunk SOAR", "action": "8937", "description": "Get a job summary for a submitted job", "type": "get job summary", "app_id": 283, "asset": 23, "parameters": [{"job_id": "", "timeout": ""}]}, {"id": "592359f5-15f0-405f-bd1b-94feeef818a1", "create_time": 1774295034.6505318, "update_time": 1788280100.5281377, "last_job_id": 0, "name": "domain reputation - Cisco Talos Intelligence", "action": "7850", "description": "Query domain info", "type": "domain reputation", "app_id": 61, "asset": 11, "parameters": [{"domain": ""}]}, {"id": "28f35544-23b8-4302-89ff-6ca0004c1809", "create_time": 1774295034.6506045, "update_time": 1788280100.5281668, "last_job_id": 0, "name": "ip reputation - Cisco Talos Intelligence", "action": "7849", "description": "Query IP info", "type": "ip reputation", "app_id": 61, "asset": 11, "parameters": [{"ip": ""}]}, {"id": "e970c5c0-d3f1-4f83-9cc7-a640ac3573ba", "create_time": 1774295034.6506772, "update_time": 1788280100.5281966, "last_job_id": 0, "name": "url reputation - Cisco Talos Intelligence", "action": "7851", "description": "Query URL info", "type": "url reputation", "app_id": 61, "asset": 11, "parameters": [{"url": ""}]}, {"id": "4fdc630a-1b12-4391-b43d-cdd2e203cdb9", "create_time": 1774295034.6507487, "update_time": 1788280100.5282252, "last_job_id": 0, "name": "domain reputation - VirusTotal v3", "action": "8999", "description": "Queries VirusTotal for domain info", "type": "domain reputation", "app_id": 323, "asset": 28, "parameters": [{"domain": ""}]}, {"id": "4ad7addc-85f1-423f-bbb3-127b419e5e4f", "create_time": 1774295034.65084, "update_time": 1788280100.5282538, "last_job_id": 0, "name": "file reputation - VirusTotal v3", "action": "9000", "description": "Queries VirusTotal for file reputation info", "type": "file reputation", "app_id": 323, "asset": 28, "parameters": [{"hash": ""}]}, {"id": "eda133de-bca5-4dfc-adb7-80c32b26a9af", "create_time": 1774295034.6509123, "update_time": 1788280100.5282822, "last_job_id": 0, "name": "ip reputation - VirusTotal v3", "action": "9002", "description": "Queries VirusTotal for IP info", "type": "ip reputation", "app_id": 323, "asset": 28, "parameters": [{"ip": ""}]}, {"id": "61ad9c71-2ac1-4ca6-93a8-2b6fac2bc23e", "create_time": 1774295034.650983, "update_time": 1788280100.5283108, "last_job_id": 0, "name": "url reputation - VirusTotal v3", "action": "9003", "description": "Queries VirusTotal for URL info (run this action after running detonate url)", "type": "url reputation", "app_id": 323, "asset": 28, "parameters": [{"url": ""}]}, {"id": "4d492999-a2cf-4f01-90c8-3c02ffc1074f", "create_time": 1774295034.6510537, "update_time": 1788280100.5283384, "last_job_id": 0, "name": "detonate file - VirusTotal v3", "action": "9005", "description": "Upload a file to Virus Total and retrieve the analysis results", "type": "detonate file", "app_id": 323, "asset": 28, "parameters": [{"vault_id": "", "wait_time": ""}]}, {"id": "b469d96c-f7d1-458e-b12a-b2e6024ef6ba", "create_time": 1774295034.6511242, "update_time": 1788280100.5283694, "last_job_id": 0, "name": "detonate url - VirusTotal v3", "action": "9004", "description": "Load a URL to Virus Total and retrieve analysis results", "type": "detonate url", "app_id": 323, "asset": 28, "parameters": [{"url": "", "wait_time": ""}]}, {"id": "dce78a62-bcde-499a-94dd-95f738db943a", "create_time": 1774295034.651194, "update_time": 1788280100.528398, "last_job_id": 0, "name": "url reputation - PhishTank", "action": "8902", "description": "Queries PhishTank for URL's phishing reputation", "type": "url reputation", "app_id": 225, "asset": 3, "parameters": [{"url": ""}]}], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}, {"id": "a947eacc-04e3-485e-bac4-6566e85df173", "create_time": 1764758755.9060266, "update_time": 1788280100.5284767, "name": "Research%20Network%20and%20Traffic%20logs%20", "order": 2, "tag": "7586c74e-6844-45bb-9535-4924752ff0de", "description": "Not%20all%20Dashboards%20may%20come%20into%20play%20depending%20on%20detection/s%20%0A%20%0AFind%20and%20document%20any%20evidence%20linked%20to%20detections.%0A%0ASuggested%20Dashboards%0A1.%20%5BWeb%20Center%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/web_center)%0A2.%20%5BTraffic%20Center%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/traffic_center)%0A3.%20%5BTraffic%20Search%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/traffic_search)%0A4.%20%5BTraffic%20Size%20Analysis%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/traffic_size_analysis)%0A5.%20%5BPort%20and%20Protocol%20Tracker%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/port_protocol_tracker)", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}, {"id": "bfa0b1ad-7bb1-484d-bcfa-16df7989518c", "create_time": 1764758755.906122, "update_time": 1788280100.528601, "name": "Research%20Authentication%20Behavior", "order": 3, "tag": "5f7e4c57-343a-4a5c-8c90-643bdb578dbb", "description": "Not%20all%20Dashboards%20may%20come%20into%20play%20depending%20on%20detection/s%20%0AFind%20and%20document%20any%20evidence%20linked%20to%20detections.%0A%0ASuggested%20Dashboards%0A1.%20%5BRisk%20Analysis%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/risk_analysis)%0A2.%20%5BAccess%20Center%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/access_center)%0A3.%20%5BAccount%20Management%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/account_management)%0A4.%20%5BAccess%20Tracker%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/access_tracker)", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}, {"id": "0168209e-eb24-4a5a-b72a-7c074a96a19c", "create_time": 1764758755.906265, "update_time": 1788280100.5287104, "name": "Research%20OS%20%20and%20Endpoint%20Logs", "order": 4, "tag": "357d8065-7af2-4968-a52e-1daba8d36bcb", "description": "Not%20all%20Dashboards%20may%20come%20into%20play%20depending%20on%20detection/s%20%0AFind%20and%20document%20any%20evidence%20linked%20to%20detections.%0A%0ASuggested%20Dashboards%0A1.%20%5BEndpoint%20Changes%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/endpoint_changes)%0A2.%20%5BMalware%20Center%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/malware_center)%0A3.%20%5BMalware%20Search%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/malware_search)", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}, {"id": "a16d098a-10a7-4b53-a798-fd83c467ddb6", "create_time": 1764758755.9069023, "update_time": 1788280100.528816, "name": "Determine%20full%20impact", "order": 5, "tag": "2419ca1b-fa9e-4443-8334-4642877218c4", "description": "Determine%20and%20Document%20Initial%20Infection%20vectors,%20attack%20targets,%20attacker%20sources,%20infected%20devices,%20compromised%20users.", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}]}, {"id": "1cfc9549-b74f-4dfd-b1c5-956b1587e546", "create_time": 1788276680.0043044, "update_time": 1788280100.530551, "name": "Containment", "order": 3, "tasks": [{"id": "91691144-6812-44e7-ae84-769b7c91778f", "create_time": 1764758755.9071276, "update_time": 1788280100.5289705, "name": "Alert%20Appropriate%20Parties%20of%20evidence%20found%20and%20recommended%20next%20actions", "order": 1, "tag": "fa5fbdd4-4224-460f-80b1-081083c3a8e5", "description": "Send%20Email%20or%20Instant%20message%20to%20appropriate%20teams%20for%20awareness%20and%20assistance%0A%0A%0ASuggested%20Integration%20(if%20not%20already%20configured%20navigate%20%5BHERE%5D(/app/SplunkEnterpriseSecuritySuite/ess_configuration/#/soar/soar_apps/apps)%20to%20locate%20and%20configure)%0A%0A-%20Smtp%20%0A-%20MS%20Graph%20for%20Office%20365%20%0A-%20G%20Suite%20for%20Gmail%20%0A-%20Cisco%20Webex%20%0A-%20Slack%20%0A-%20Microsoft%20Teams", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [{"id": "79483e20-2181-4940-8225-94c2d222e631", "create_time": 1788278442.8867176, "update_time": 1788280100.5290368, "last_job_id": 0, "name": "send email - SMTP", "action": "1903", "description": "Sends an email", "type": "send email", "app_id": 139, "asset": 6, "parameters": [{"cc": "", "to": "", "bcc": "", "body": "", "from": "", "headers": "", "subject": "", "attachments": ""}]}, {"id": "29954e34-f374-48b8-ac1d-ed2d53750ff5", "create_time": 1788278442.886742, "update_time": 1788280100.5290687, "last_job_id": 0, "name": "send email - MS Graph for Office 365", "action": "2339", "description": "Sends an email with optional text rendering. Attachments are allowed a Content-ID tag for reference within the html", "type": "send email", "app_id": 97, "asset": 32, "parameters": [{"cc": "", "to": "", "bcc": "", "body": "", "from": "", "headers": "", "subject": "", "attachments": ""}]}, {"id": "5acb959b-9bf7-4213-9ca4-0237a9191d61", "create_time": 1788278442.8867648, "update_time": 1788280100.5290997, "last_job_id": 0, "name": "send email - G Suite for GMail", "action": "2952", "description": "Send email via Gmail.\n\nConstructs MIME message with attachments, respecting 25MB size limit.\nOptionally creates send-as alias before sending.", "type": "send email", "app_id": 88, "asset": 35, "parameters": [{"cc": "", "to": "", "bcc": "", "body": "", "from": "", "headers": "", "subject": "", "reply_to": "", "alias_name": "", "alias_email": "", "attachments": ""}]}, {"id": "f0239d21-9be0-4768-9971-cb03a109fb8c", "create_time": 1788278442.8867874, "update_time": 1788280100.5291348, "last_job_id": 0, "name": "send message - Cisco Webex", "action": "2960", "description": "Send message to user or room", "type": "send message", "app_id": 42, "asset": 36, "parameters": [{"card": "", "message": "", "vault_id": "", "endpoint_id": "", "is_markdown": false, "destination_type": ""}]}, {"id": "2a6dc7f4-2326-4ca4-b9c3-e824c14e735e", "create_time": 1788278442.8868096, "update_time": 1788280100.529166, "last_job_id": 0, "name": "send message - Slack", "action": "2498", "description": "Send a message to Slack", "type": "send message", "app_id": 152, "asset": 17, "parameters": [{"blocks": "", "message": "", "link_names": false, "destination": "", "reply_broadcast": false, "parent_message_ts": ""}]}, {"id": "ac4ad54a-6826-4758-bd4b-7ea9366d1811", "create_time": 1788278442.8868325, "update_time": 1788280100.5291967, "last_job_id": 0, "name": "send chat message - Microsoft Teams", "action": "2979", "description": "Send a message to specific chat", "type": "send chat message", "app_id": 125, "asset": 37, "parameters": [{"chat_id": "", "message": ""}]}], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}, {"id": "884da2c4-4fb8-494f-bd5a-2c0eacb81646", "create_time": 1764758755.9072351, "update_time": 1788280100.5292842, "name": "Block%20Malicious%20URL%20and%20%20IPs", "order": 2, "tag": "f735a650-8d7e-42ee-95fa-ca8122e29df4", "description": "Using%20the%20information%20documented%20in%20evidence%20if%20applies%20block%20any%20malicious%20or%20compromised%20URLs%20or%20IPs%0A%0ASuggested%20Integration%20(%20if%20not%20already%20configured%20navigate%20%5BHERE%5D(/app/SplunkEnterpriseSecuritySuite/ess_configuration/#/soar/soar_apps/apps)%20to%20locate%20and%20configure)%0A1.%20Cisco%20Firepower%20%0A2.%20Cisco%20Secure%20Firewall%20%0A3.%20Palo%20Alto%20%0A4.%20Zscaler%20%0A5.%20VMware%20Carbon%20Black%20Cloud%20for%20Splunk%20SOAR", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [{"id": "8e293ed1-ff03-4401-a9a3-39e7b7eb2d8a", "create_time": 1788278624.1030524, "update_time": 1788280100.5293477, "last_job_id": 0, "name": "block ip - Cisco Firepower", "action": "2989", "description": "Blocks an IP network", "type": "block ip", "app_id": 35, "asset": 38, "parameters": [{"ip": ""}]}, {"id": "0a955b4b-e637-429c-ac6f-b8baed5cc5c9", "create_time": 1788278624.1030767, "update_time": 1788280100.5293787, "last_job_id": 0, "name": "delete network object - Cisco Secure Firewall", "action": "2995", "description": "Deletes a network object in FMC", "type": "delete network object", "app_id": 37, "asset": 39, "parameters": [{"type": "", "object_id": "", "domain_name": ""}]}, {"id": "805b7d47-1625-4a45-abe3-d187d94fbdae", "create_time": 1788278624.1030996, "update_time": 1788280100.5294104, "last_job_id": 0, "name": "block ip - Panorama", "action": "2395", "description": "Block an IP", "type": "block ip", "app_id": 119, "asset": 10, "parameters": [{"ip": "", "policy_name": "", "policy_type": "", "device_group": "", "audit_comment": "", "should_add_tag": false, "is_source_address": false, "use_partial_commit": false, "should_commit_changes": false}]}, {"id": "984a01e3-f98b-4500-8e1e-1308536615c3", "create_time": 1788278624.1031215, "update_time": 1788280100.5294404, "last_job_id": 0, "name": "block url - Panorama", "action": "2391", "description": "Block an URL", "type": "block url", "app_id": 119, "asset": 10, "parameters": [{"url": "", "policy_name": "", "policy_type": "", "device_group": "", "audit_comment": "", "use_partial_commit": false, "should_commit_changes": false}]}, {"id": "939506af-4344-4903-8716-2c98620b1108", "create_time": 1788278624.1031427, "update_time": 1788280100.529471, "last_job_id": 0, "name": "block ip - Zscaler", "action": "2798", "description": "Block an IP", "type": "block ip", "app_id": 183, "asset": 24, "parameters": [{"ip": "", "url_category": ""}]}, {"id": "7d44cabe-dc7f-4282-9c65-982acc17af71", "create_time": 1788278624.1031644, "update_time": 1788280100.5295005, "last_job_id": 0, "name": "block url - Zscaler", "action": "2799", "description": "Block a URL", "type": "block url", "app_id": 183, "asset": 24, "parameters": [{"url": "", "url_category": ""}]}, {"id": "4972f488-4a2a-43b3-9380-67eaf963f2a3", "create_time": 1788278624.1031861, "update_time": 1788280100.5295336, "last_job_id": 0, "name": "unallow ip - Zscaler", "action": "2804", "description": "Remove an IP address from the allowlist", "type": "unallow ip", "app_id": 183, "asset": 24, "parameters": [{"ip": "", "url_category": ""}]}, {"id": "5a94c3aa-4d81-4803-9bb0-c04abf4a66fd", "create_time": 1788278624.1032078, "update_time": 1788280100.5295634, "last_job_id": 0, "name": "unallow url - Zscaler", "action": "2805", "description": "Remove a URL from the allowed list", "type": "unallow url", "app_id": 183, "asset": 24, "parameters": [{"url": "", "url_category": ""}]}], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}, {"id": "5b6fd766-744a-4ada-9612-9934ff090668", "create_time": 1764758755.9073257, "update_time": 1788280100.5296493, "name": "Block%20Applications%20and%20Hashes", "order": 3, "tag": "de5b8d96-bc90-47e5-a707-4b4ce273b2f5", "description": "Using%20the%20information%20documented%20in%20evidence%20if%20applies%20block%20any%20malicious%20or%20compromised%20applications%0A%0ASuggested%20Integration%20(%20if%20not%20already%20configured%20navigate%20%5BHERE%5D(/app/SplunkEnterpriseSecuritySuite/ess_configuration/#/soar/soar_apps/apps)%20to%20locate%20and%20configure)%0A1.%20Palo%20Alto/Panorama%0A2.%20VMware%20Carbon%20Black%20Cloud%20for%20Splunk%20SOAR", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [{"id": "4aeae82c-9dd1-40c2-a202-8c1681107ad0", "create_time": 1788278773.9890056, "update_time": 1788280100.5297146, "last_job_id": 0, "name": "block application - Panorama", "action": "2393", "description": "Block an application", "type": "block application", "app_id": 119, "asset": 10, "parameters": [{"application": "", "policy_name": "", "policy_type": "", "device_group": "", "audit_comment": "", "use_partial_commit": false, "should_commit_changes": false}]}, {"id": "aab34ec2-4c29-454f-a4c6-977593bb4223", "create_time": 1788278773.9890535, "update_time": 1788280100.5297453, "last_job_id": 0, "name": "block hash - Carbon Black Response", "action": "2075", "description": "Add a hash to the Carbon Black Response blacklist", "type": "block hash", "app_id": 28, "asset": 12, "parameters": [{"hash": "", "comment": ""}]}, {"id": "efce157a-05de-44a0-9068-8a89c805cabb", "create_time": 1788278773.9890966, "update_time": 1788280100.5297751, "last_job_id": 0, "name": "terminate process - Carbon Black Response", "action": "2067", "description": "Kill running processes on a machine", "type": "terminate process", "app_id": 28, "asset": 12, "parameters": [{"pid": "", "sensor_id": "", "ip_hostname": ""}]}], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}, {"id": "c21f1448-9c99-4d7b-818e-d803780529ad", "create_time": 1788279259.257031, "update_time": 1788280100.5298517, "name": "Quarantine%20compromised%20devices%20or%20endpoints", "order": 4, "tag": "de175899-36ac-48d6-9ca4-fa1f31c46019", "description": "Using%20the%20information%20documented%20in%20evidence%20if%20applies%20quarantine%20any%20compromised%20devices.%0A%0ASuggested%20Integration%20(%20if%20not%20already%20configured%20navigate%20%5BHERE%5D(/app/SplunkEnterpriseSecuritySuite/ess_configuration/#/soar/soar_apps/apps)%20to%20locate%20and%20configure)%0A1.%20Crowdstrike%0A2.%20Microsoft%20Defender%20for%20Endpoint%0A3.%20VMware%20Carbon%20Black%20Cloud%20for%20Splunk%20SOAR", "owner": "", "is_note_required": true, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [{"id": "306acb45-61e8-4af7-8836-7f5b23e79f13", "create_time": 1788279409.7877266, "update_time": 1788280100.5299373, "last_job_id": 0, "name": "quarantine device - CrowdStrike OAuth API", "action": "2153", "description": "Block the device", "type": "quarantine device", "app_id": 48, "asset": 19, "parameters": [{"hostname": "", "device_id": ""}]}, {"id": "8e3459f3-a1d1-4230-8461-7ef56dc5a843", "create_time": 1788279409.7877512, "update_time": 1788280100.5299702, "last_job_id": 0, "name": "quarantine device - Windows Defender ATP", "action": "2698", "description": "Quarantine the device", "type": "quarantine device", "app_id": 101, "asset": 40, "parameters": [{"type": "", "comment": "", "timeout": "", "device_id": ""}]}, {"id": "889e7a1d-0df0-43d1-81b9-46ab7359ffba", "create_time": 1788279409.7877738, "update_time": 1788280100.5300007, "last_job_id": 0, "name": "quarantine file - Windows Defender ATP", "action": "2702", "description": "Quarantine a file", "type": "quarantine file", "app_id": 101, "asset": 40, "parameters": [{"comment": "", "timeout": "", "device_id": "", "file_hash": ""}]}, {"id": "7b3a2d28-4942-4598-bffc-7c1f4515ec72", "create_time": 1788279409.787797, "update_time": 1788280100.530035, "last_job_id": 0, "name": "restrict app execution - Windows Defender ATP", "action": "2715", "description": "Restrict execution of all applications on the device except a predefined set", "type": "restrict app execution", "app_id": 101, "asset": 40, "parameters": [{"comment": "", "timeout": "", "device_id": ""}]}, {"id": "5a8eb830-4b4a-411c-993c-fc5ac42da7ef", "create_time": 1788279409.7878232, "update_time": 1788280100.5300653, "last_job_id": 0, "name": "quarantine device - Carbon Black Response", "action": "2062", "description": "Quarantine the endpoint", "type": "quarantine device", "app_id": 28, "asset": 12, "parameters": [{"ip_hostname": ""}]}], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}, {"id": "e2eefabb-dd45-4647-a347-b8a66c3bd2ed", "create_time": 1788279702.6294243, "update_time": 1788280100.5301492, "name": "Disable%20any%20compromised%20or%20malicious%20accounts%20or%20tokens", "order": 5, "tag": "8cd82a46-eb24-4bb7-8023-34d779e4c4d2", "description": "Using%20the%20information%20documented%20in%20evidence%20if%20applies%20Disable%20any%20compromised%20or%20malicious%20accounts%20or%20tokens.%0A%0ASuggested%20Integration%20(%20if%20not%20already%20configured%20navigate%20%5BHERE%5D(/app/SplunkEnterpriseSecuritySuite/ess_configuration/#/soar/soar_apps/apps)%20to%20locate%20and%20configure)%0A%0A1.%20MS%20Graph%20For%20Active%20Directory%20%0A2.%20AD%20LDAP%20%0A3.%20Okta%20%0A4.%20AWS%20IAM%20%0A5.%20Azure%20AD%20Graph", "owner": "", "is_note_required": true, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [{"id": "0b3091e6-c58b-495c-bf1e-92fda2468d00", "create_time": 1788279702.6294713, "update_time": 1788280100.5302153, "last_job_id": 0, "name": "disable account - AD LDAP", "action": "1930", "description": "Disables an Active Directory account", "type": "disable account", "app_id": 2, "asset": 28, "parameters": [{"user": "", "use_samaccountname": false}]}, {"id": "cb9c0ef7-748d-43ea-a0a0-1ba7dbe433cc", "create_time": 1788279702.629496, "update_time": 1788280100.5302463, "last_job_id": 0, "name": "reset password - AD LDAP", "action": "1932", "description": "Resets the password of a user, requiring the user to change password at next login", "type": "reset password", "app_id": 2, "asset": 28, "parameters": [{"user": "", "use_samaccountname": false}]}, {"id": "efcd23da-9a95-4a84-927c-5a80668bf16e", "create_time": 1788279702.629519, "update_time": 1788280100.5302763, "last_job_id": 0, "name": "disable user - Azure AD Graph", "action": "2019", "description": "Disable a user", "type": "disable user", "app_id": 14, "asset": 21, "parameters": [{"user_id": ""}]}, {"id": "73978225-62b4-49d4-b779-e38a85469279", "create_time": 1788279702.6295414, "update_time": 1788280100.5303059, "last_job_id": 0, "name": "reset password - Azure AD Graph", "action": "2016", "description": "Reset or set a user's password in an Azure AD environment", "type": "reset password", "app_id": 14, "asset": 21, "parameters": [{"user_id": "", "force_change": false, "temp_password": ""}]}, {"id": "89d063f3-11e3-49c7-957a-b07b8b9fb141", "create_time": 1788279702.629564, "update_time": 1788280100.5303347, "last_job_id": 0, "name": "disable tokens - Azure AD Graph", "action": "2017", "description": "Invalidate all active refresh tokens for a user in an Azure AD environment", "type": "disable tokens", "app_id": 14, "asset": 21, "parameters": [{"user_id": ""}]}, {"id": "0f2fe1cc-260d-4200-b13d-bcf6aa3ec877", "create_time": 1788279702.629587, "update_time": 1788280100.5303638, "last_job_id": 0, "name": "disable user - AWS IAM", "action": "3044", "description": "Disable login profile and access keys of a user", "type": "disable user", "app_id": 6, "asset": 42, "parameters": [{"username": "", "credentials": "", "disable_access_keys": false}]}, {"id": "e3f709da-f0a0-4140-b837-109df13fbb5e", "create_time": 1788279702.629611, "update_time": 1788280100.5303931, "last_job_id": 0, "name": "disable user - Okta", "action": "2367", "description": "Disables the specified user", "type": "disable user", "app_id": 118, "asset": 13, "parameters": [{"id": ""}]}, {"id": "fac660ff-6fa7-4952-8924-46e41746cfd8", "create_time": 1788279702.6296341, "update_time": 1788280100.5304255, "last_job_id": 0, "name": "disable user - MS Graph for Active Directory", "action": "3021", "description": "Disable a user", "type": "disable user", "app_id": 89, "asset": 41, "parameters": [{"user_id": ""}]}, {"id": "7fed8e92-ceb2-44fa-9711-5a23ed3342c2", "create_time": 1788279702.6296563, "update_time": 1788280100.5304606, "last_job_id": 0, "name": "disable tokens - MS Graph for Active Directory", "action": "3019", "description": "Invalidate all active refresh tokens for a user in a Microsoft AD environment", "type": "disable tokens", "app_id": 89, "asset": 41, "parameters": [{"user_id": ""}]}, {"id": "48c0cfa5-084a-447c-9f44-cd67be2c6ddd", "create_time": 1788279702.6296782, "update_time": 1788280100.53049, "last_job_id": 0, "name": "reset password - MS Graph for Active Directory", "action": "3018", "description": "Reset or set a user's password in a Microsoft AD environment", "type": "reset password", "app_id": 89, "asset": 41, "parameters": [{"user_id": "", "force_change": false, "temp_password": ""}]}], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}]}, {"id": "50452b43-98af-43ab-bfb0-1e9f7368b2c9", "create_time": 1788276680.0046902, "update_time": 1788280100.5313852, "name": "Recovery", "order": 4, "tasks": [{"id": "91a74317-f931-4ced-b4aa-6cdf54433221", "create_time": 1764758755.9079046, "update_time": 1788280100.5306091, "name": "Verify%20the%20integrity%20of%20restored%20assets,%20confirm%20normal%20operations%20with%20system%20owners,%20monitor%20for%20signs%20of%20recurrence", "order": 1, "tag": "c3c83a87-0d75-4d0a-b4e7-9fef0d60e5f4", "description": "Define%20who%20owns%20recovery%20execution,%20who%20approves%20restoration,%20and%20what%20systems/users/services%20are%20in%20scope.%20%0AVerify%20the%20integrity%20of%20restored%20assets,%20confirm%20normal%20operations%20with%20system%20owners,%20and%20monitor%20signs%20of%20recurrence.", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}, {"id": "91f6342d-a92b-4157-a124-5e87ab0c9827", "create_time": 1764758755.9080007, "update_time": 1788280100.5307238, "name": "Complete%20incident%20documentation%20and%20lessons%20learned%20before%20closure", "order": 2, "tag": "27d8d5a5-4c1b-470c-b995-c39275b61444", "description": "Root%20Cause%20Analysis.%20%20New%20Detections,%20Visualizations,%20responses%20or%20playbooks%20to%20help%20resolve%20in%20future.%20", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}, {"id": "5840a534-399b-4ac1-b0bc-80927edf8f8b", "create_time": 1764758755.9080942, "update_time": 1788280100.5308282, "name": "Report%20incident%20response%20status", "order": 3, "tag": "085d0c66-3bb9-48c8-9403-0fc21217d77c", "description": "Alert%20appropriate%20parties%20that%20incident%20response%20is%20complete.%0A%0ASuggested%20Integration%20(if%20not%20already%20configured%20navigate%20%5BHERE%5D(/app/SplunkEnterpriseSecuritySuite/ess_configuration/#/soar/soar_apps/apps)%20to%20locate%20and%20configure)%0A%0A-%20Smtp%20%0A-%20MS%20Graph%20for%20Office%20365%20%0A-%20G%20Suite%20for%20Gmail%20%0A-%20Cisco%20Webex%20%0A-%20Slack%20%0A-%20Microsoft%20Teams", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [{"id": "2bcf6e5e-de9b-42bd-b24c-d4cdd423cb13", "create_time": 1788279986.6035137, "update_time": 1788280100.5308995, "last_job_id": 0, "name": "send email - SMTP", "action": "1903", "description": "Sends an email", "type": "send email", "app_id": 139, "asset": 6, "parameters": [{"cc": "", "to": "", "bcc": "", "body": "", "from": "", "headers": "", "subject": "", "attachments": ""}]}, {"id": "393db9ae-69e9-4172-8b08-a7e59cf20aa9", "create_time": 1788279986.6035569, "update_time": 1788280100.5309548, "last_job_id": 0, "name": "send email - MS Graph for Office 365", "action": "2339", "description": "Sends an email with optional text rendering. Attachments are allowed a Content-ID tag for reference within the html", "type": "send email", "app_id": 97, "asset": 32, "parameters": [{"cc": "", "to": "", "bcc": "", "body": "", "from": "", "headers": "", "subject": "", "attachments": ""}]}, {"id": "d80a5892-bc25-4b3a-be22-af3620e30994", "create_time": 1788279986.6036005, "update_time": 1788280100.530988, "last_job_id": 0, "name": "send email - G Suite for GMail", "action": "2952", "description": "Send email via Gmail.\n\nConstructs MIME message with attachments, respecting 25MB size limit.\nOptionally creates send-as alias before sending.", "type": "send email", "app_id": 88, "asset": 35, "parameters": [{"cc": "", "to": "", "bcc": "", "body": "", "from": "", "headers": "", "subject": "", "reply_to": "", "alias_name": "", "alias_email": "", "attachments": ""}]}, {"id": "4d83b65b-55b8-4d55-81a0-1e7ee2e25ade", "create_time": 1788279986.6036437, "update_time": 1788280100.5310204, "last_job_id": 0, "name": "send message - Cisco Webex", "action": "2960", "description": "Send message to user or room", "type": "send message", "app_id": 42, "asset": 36, "parameters": [{"card": "", "message": "", "vault_id": "", "endpoint_id": "", "is_markdown": false, "destination_type": ""}]}, {"id": "db31bdad-1648-4426-bb85-2fed1912d79d", "create_time": 1788279986.6036847, "update_time": 1788280100.5310526, "last_job_id": 0, "name": "send message - Slack", "action": "2498", "description": "Send a message to Slack", "type": "send message", "app_id": 152, "asset": 17, "parameters": [{"blocks": "", "message": "", "link_names": false, "destination": "", "reply_broadcast": false, "parent_message_ts": ""}]}, {"id": "49790c40-0d53-4598-b162-25d69c9ce19b", "create_time": 1788279986.603725, "update_time": 1788280100.5310874, "last_job_id": 0, "name": "send chat message - Microsoft Teams", "action": "2979", "description": "Send a message to specific chat", "type": "send chat message", "app_id": 125, "asset": 37, "parameters": [{"chat_id": "", "message": ""}]}], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}, {"id": "a18d484f-0600-490d-9b4c-52851cd7b767", "create_time": 1788280100.5311828, "update_time": 1788280100.5311832, "name": "Update%20and%20close%20company-wide%20awareness%20tickets%20when%20appropriate.", "order": 4, "tag": "44b218d8-0a50-47f1-a5ed-20a5c73ff522", "description": "Update%20Incident%20to%20track%20notes%20from%20the%20investigaiton.%0A%0ASuggested%20Integration%20(if%20not%20already%20configured%20navigate%20%5BHERE%5D(/app/SplunkEnterpriseSecuritySuite/ess_configuration/#/soar/soar_apps/apps)%20to%20locate%20and%20configure)%0A%0A-%20Service%20Now%20%0A-%20Salesforce%20%0A-%20Jira", "owner": "", "is_note_required": true, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [{"id": "cc88b369-e5e6-4d63-9d88-97d985edd8f8", "create_time": 1788280100.5312567, "update_time": 1788280100.5312572, "last_job_id": 0, "name": "update ticket - ServiceNow", "action": "2473", "description": "Update ticket/record information", "type": "update ticket", "app_id": 147, "asset": 29, "parameters": [{"id": "", "table": "", "fields": "", "vault_id": "", "is_sys_id": false}]}, {"id": "99b0e0e2-2efd-4f9f-b4f4-6e68501acb3a", "create_time": 1788280100.5312977, "update_time": 1788280100.5312986, "last_job_id": 0, "name": "update ticket - Salesforce", "action": "2937", "description": "Update a Case", "type": "update ticket", "app_id": 144, "asset": 34, "parameters": [{"id": "", "status": "", "subject": "", "priority": "", "description": "", "field_values": "", "parent_case_id": ""}]}, {"id": "cc9e1aca-7be7-4b4c-a5ff-7c4929e8dd73", "create_time": 1788280100.531338, "update_time": 1788280100.5313385, "last_job_id": 0, "name": "update ticket - Jira", "action": "2287", "description": "Update ticket (issue)", "type": "update ticket", "app_id": 80, "asset": 31, "parameters": [{"id": "", "vault_id": "", "update_fields": ""}]}], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}]}], "origin": {"id": "67fc1f68-1928-4436-8525-2957aac3a534", "name": "Generic Incident Response", "version": 4}, "template_id": "69f3e851-6e19-4ecd-ae2b-7cd558d49133", "active": true, "used": false, "ai_generated": false, "source_attachment_id": null, "_user": "nobody", "_key": "bd873ed6-1463-4fbf-a184-8cc3ad7c446c"}
\ No newline at end of file
+{"id": "bd873ed6-1463-4fbf-a184-8cc3ad7c446c", "create_time": 1788276134.3671353, "update_time": 1788280100.5796342, "name": "Generic Incident Response", "description": "Use%20this%20as%20a%20starting%20point.%20This%20will%20guide%20you%20to%20visualizations%20and%20dashboards%20within%20Splunk%20Enterprise%20Security%20that%20you%20would%20use%20to%20research%20and%20interrogate%20different%20data%20types%20like%20Authentication,%20Endpoint%20or%20Network.%20%20The%20Suggested%20Integrations(connectors)%20are%20just%20that,%20either%20built%20into%20Splunk%20SOAR%20or%20commonly%20used%20by%20customers.%20The%20Actions%20included%20will%20need%20to%20be%20reviewed,%20removed,%20validated,%20or%20added%20based%20on%20what%20tools%20your%20organizations%20use.%20%20Before%20implementing%20be%20sure%20to%20add%20roles%20and%20approvals%20to%20ensure%20proper%20review%20occurs%20in%20the%20incident%20response%20workflow%20", "template_status": "published", "creator": "splunker", "updated_by": "splunker", "is_default": false, "version": 4, "phases": [{"id": "c8c1bb29-a14c-4230-ba02-283f98645b90", "create_time": 1788276680.0027182, "update_time": 1788280100.5278718, "name": "Initial%20Reporting%20and%20Awareness%20", "order": 1, "tasks": [{"id": "76fd8383-b2f7-47d8-b952-49a60105c23f", "create_time": 1764758755.9055116, "update_time": 1788280100.527043, "name": "Ensure%20Investigations%20are%20mirrored%20in%20the%20core%20enterprise%20tracking%20system.", "order": 1, "tag": "69c9baf1-bd12-4b09-b6b6-a77df9428682", "description": "Open%20Incident%20to%20track%0A%0ASuggested%20Integration%20(if%20not%20already%20configured%20navigate%20%5BHERE%5D(/app/SplunkEnterpriseSecuritySuite/ess_configuration/#/soar/soar_apps/apps)%20to%20locate%20and%20configure)%0A%0A-%20Service%20Now%20%0A-%20Salesforce%20%0A-%20Jira", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [{"id": "3ff21177-da2b-4c47-acc7-b44d4dd0dc2a", "create_time": 1788276603.7561357, "update_time": 1788280100.5271513, "last_job_id": 0, "name": "create ticket - ServiceNow", "action": "2471", "description": "Create a new ticket/record", "type": "create ticket", "app_id": 147, "asset": 29, "parameters": [{"table": "", "fields": "", "vault_id": "", "description": "", "short_description": ""}]}, {"id": "71f70831-5652-41d8-a05e-6d4c7221b81d", "create_time": 1788276680.0023613, "update_time": 1788280100.5271919, "last_job_id": 0, "name": "create ticket - Salesforce", "action": "2933", "description": "Create a new Case", "type": "create ticket", "app_id": 144, "asset": 34, "parameters": [{"subject": "", "priority": "", "description": "", "field_values": "", "parent_case_id": ""}]}, {"id": "45052d6d-ffd0-4491-9434-af7c69b6544d", "create_time": 1788276680.0023906, "update_time": 1788280100.5272317, "last_job_id": 0, "name": "create ticket - Jira", "action": "2285", "description": "Create a ticket (issue)", "type": "create ticket", "app_id": 80, "asset": 31, "parameters": [{"fields": "", "summary": "", "assignee": "", "priority": "", "vault_id": "", "issue_type": "", "description": "", "project_key": "", "assignee_account_id": ""}]}], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}, {"id": "c62f8956-c622-4c11-a664-9d68661f2df1", "create_time": 1764758755.905616, "update_time": 1788280100.5275803, "name": "Alert%20Appropriate%20Parties%20that%20Incident%20Response%20Is%20Starting", "order": 2, "tag": "8ca56a2a-f0d7-43c1-96e3-06bac95deffe", "description": "Send%20Email%20or%20Instant%20message%20to%20appropriate%20teams%20for%20awareness%20and%20assistance%0A%0A%0A%0A%0ASuggested%20Integration%20(if%20not%20already%20configured%20navigate%20%5BHERE%5D(/app/SplunkEnterpriseSecuritySuite/ess_configuration/#/soar/soar_apps/apps)%20to%20locate%20and%20configure)%0A%0A-%20Smtp%20%0A-%20MS%20Graph%20for%20Office%20365%20%0A-%20G%20Suite%20for%20Gmail%20%0A-%20Cisco%20Webex%20%0A-%20Slack%20%0A-%20Microsoft%20Teams", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [{"id": "b7f1588d-09e9-4fe8-b72a-27c599eb2a8d", "create_time": 1788277531.9986718, "update_time": 1788280100.527657, "last_job_id": 0, "name": "send email - SMTP", "action": "1903", "description": "Sends an email", "type": "send email", "app_id": 139, "asset": 6, "parameters": [{"cc": "", "to": "", "bcc": "", "body": "", "from": "", "headers": "", "subject": "", "attachments": ""}]}, {"id": "70c65ce6-06b9-4fbc-9f9b-362f2f4a4817", "create_time": 1788277531.9986978, "update_time": 1788280100.5276885, "last_job_id": 0, "name": "send email - MS Graph for Office 365", "action": "2339", "description": "Sends an email with optional text rendering. Attachments are allowed a Content-ID tag for reference within the html", "type": "send email", "app_id": 97, "asset": 32, "parameters": [{"cc": "", "to": "", "bcc": "", "body": "", "from": "", "headers": "", "subject": "", "attachments": ""}]}, {"id": "24d8b79b-e9a5-43a3-a971-fcbf1d4f02d7", "create_time": 1788277531.998722, "update_time": 1788280100.5277174, "last_job_id": 0, "name": "send email - G Suite for GMail", "action": "2952", "description": "Send email via Gmail.\n\nConstructs MIME message with attachments, respecting 25MB size limit.\nOptionally creates send-as alias before sending.", "type": "send email", "app_id": 88, "asset": 35, "parameters": [{"cc": "", "to": "", "bcc": "", "body": "", "from": "", "headers": "", "subject": "", "reply_to": "", "alias_name": "", "alias_email": "", "attachments": ""}]}, {"id": "4ff61fec-6cb7-4dd8-9b63-ca3ea2e1a18d", "create_time": 1788277531.9987452, "update_time": 1788280100.5277452, "last_job_id": 0, "name": "send message - Cisco Webex", "action": "2960", "description": "Send message to user or room", "type": "send message", "app_id": 42, "asset": 36, "parameters": [{"card": "", "message": "", "vault_id": "", "endpoint_id": "", "is_markdown": false, "destination_type": ""}]}, {"id": "5b82f7e8-0e65-46e0-916c-d0c487e5b65a", "create_time": 1788277531.9987676, "update_time": 1788280100.5277727, "last_job_id": 0, "name": "send message - Slack", "action": "2498", "description": "Send a message to Slack", "type": "send message", "app_id": 152, "asset": 17, "parameters": [{"blocks": "", "message": "", "link_names": false, "destination": "", "reply_broadcast": false, "parent_message_ts": ""}]}, {"id": "8af7ff80-2510-4ec6-aa55-d88d3406b5f8", "create_time": 1788277531.9987895, "update_time": 1788280100.5278, "last_job_id": 0, "name": "send chat message - Microsoft Teams", "action": "2979", "description": "Send a message to specific chat", "type": "send chat message", "app_id": 125, "asset": 37, "parameters": [{"chat_id": "", "message": ""}]}], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}]}, {"id": "816cf263-fcdd-45d6-8f5f-f4c5c3f638bd", "create_time": 1788276680.0036306, "update_time": 1788280100.528886, "name": "Analysis", "order": 2, "tasks": [{"id": "2444a355-821e-4485-86c5-03c836cba7c5", "create_time": 1764758755.9059348, "update_time": 1788280100.5279753, "name": "Research intelligence resources", "order": 1, "tag": "595d75bb-316e-4dec-bfc6-6729d3e7b280", "description": "Review%20Intelligence%20resources%20including%20Splunk%20Attack%20Analyzer%20and%20Cisco%20Talos%20in%20the%20Intelligence%20Tab%20of%20investigation%0A%0ASuggested%20Integration%20(%20if%20not%20already%20configured%20navigate%20%5BHERE%5D(/app/SplunkEnterpriseSecuritySuite/ess_configuration/#/soar/soar_apps/apps)%20to%20locate%20and%20configure)%0A1.%20Splunk%20Attack%20Analyzer%0A2.%20Cisco%20Talos%20Intelligence%0A3.%20VirusTotal%20v3%0A4.%20PhishTank%20(preconfigured)", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [{"id": "0d079a95-c063-4b33-87ba-25fe661a9ece", "create_time": 1774295034.6502967, "update_time": 1788280100.5280461, "last_job_id": 0, "name": "detonate file - Splunk Attack Analyzer Connector for Splunk SOAR", "action": "8939", "description": "Submit File for Scanning", "type": "detonate file", "app_id": 283, "asset": 23, "parameters": [{"file": "", "ph_0": "", "profile": "", "user_agent": "", "internet_region": "", "archive_password": "", "custom_user_agent": ""}]}, {"id": "efe8365d-975e-4aa6-a26e-6eeca46a39e4", "create_time": 1774295034.650387, "update_time": 1788280100.5280788, "last_job_id": 0, "name": "detonate url - Splunk Attack Analyzer Connector for Splunk SOAR", "action": "8940", "description": "Submit New URL for Scanning", "type": "detonate url", "app_id": 283, "asset": 23, "parameters": [{"url": "", "ph_0": "", "profile": "", "user_agent": "", "internet_region": "", "archive_password": "", "custom_user_agent": ""}]}, {"id": "60f5815d-8d11-490d-870c-3e174acc2cdd", "create_time": 1774295034.650461, "update_time": 1788280100.5281093, "last_job_id": 0, "name": "get job summary - Splunk Attack Analyzer Connector for Splunk SOAR", "action": "8937", "description": "Get a job summary for a submitted job", "type": "get job summary", "app_id": 283, "asset": 23, "parameters": [{"job_id": "", "timeout": ""}]}, {"id": "592359f5-15f0-405f-bd1b-94feeef818a1", "create_time": 1774295034.6505318, "update_time": 1788280100.5281377, "last_job_id": 0, "name": "domain reputation - Cisco Talos Intelligence", "action": "7850", "description": "Query domain info", "type": "domain reputation", "app_id": 61, "asset": 11, "parameters": [{"domain": ""}]}, {"id": "28f35544-23b8-4302-89ff-6ca0004c1809", "create_time": 1774295034.6506045, "update_time": 1788280100.5281668, "last_job_id": 0, "name": "ip reputation - Cisco Talos Intelligence", "action": "7849", "description": "Query IP info", "type": "ip reputation", "app_id": 61, "asset": 11, "parameters": [{"ip": ""}]}, {"id": "e970c5c0-d3f1-4f83-9cc7-a640ac3573ba", "create_time": 1774295034.6506772, "update_time": 1788280100.5281966, "last_job_id": 0, "name": "url reputation - Cisco Talos Intelligence", "action": "7851", "description": "Query URL info", "type": "url reputation", "app_id": 61, "asset": 11, "parameters": [{"url": ""}]}, {"id": "4fdc630a-1b12-4391-b43d-cdd2e203cdb9", "create_time": 1774295034.6507487, "update_time": 1788280100.5282252, "last_job_id": 0, "name": "domain reputation - VirusTotal v3", "action": "8999", "description": "Queries VirusTotal for domain info", "type": "domain reputation", "app_id": 323, "asset": 28, "parameters": [{"domain": ""}]}, {"id": "4ad7addc-85f1-423f-bbb3-127b419e5e4f", "create_time": 1774295034.65084, "update_time": 1788280100.5282538, "last_job_id": 0, "name": "file reputation - VirusTotal v3", "action": "9000", "description": "Queries VirusTotal for file reputation info", "type": "file reputation", "app_id": 323, "asset": 28, "parameters": [{"hash": ""}]}, {"id": "eda133de-bca5-4dfc-adb7-80c32b26a9af", "create_time": 1774295034.6509123, "update_time": 1788280100.5282822, "last_job_id": 0, "name": "ip reputation - VirusTotal v3", "action": "9002", "description": "Queries VirusTotal for IP info", "type": "ip reputation", "app_id": 323, "asset": 28, "parameters": [{"ip": ""}]}, {"id": "61ad9c71-2ac1-4ca6-93a8-2b6fac2bc23e", "create_time": 1774295034.650983, "update_time": 1788280100.5283108, "last_job_id": 0, "name": "url reputation - VirusTotal v3", "action": "9003", "description": "Queries VirusTotal for URL info (run this action after running detonate url)", "type": "url reputation", "app_id": 323, "asset": 28, "parameters": [{"url": ""}]}, {"id": "4d492999-a2cf-4f01-90c8-3c02ffc1074f", "create_time": 1774295034.6510537, "update_time": 1788280100.5283384, "last_job_id": 0, "name": "detonate file - VirusTotal v3", "action": "9005", "description": "Upload a file to Virus Total and retrieve the analysis results", "type": "detonate file", "app_id": 323, "asset": 28, "parameters": [{"vault_id": "", "wait_time": ""}]}, {"id": "b469d96c-f7d1-458e-b12a-b2e6024ef6ba", "create_time": 1774295034.6511242, "update_time": 1788280100.5283694, "last_job_id": 0, "name": "detonate url - VirusTotal v3", "action": "9004", "description": "Load a URL to Virus Total and retrieve analysis results", "type": "detonate url", "app_id": 323, "asset": 28, "parameters": [{"url": "", "wait_time": ""}]}, {"id": "dce78a62-bcde-499a-94dd-95f738db943a", "create_time": 1774295034.651194, "update_time": 1788280100.528398, "last_job_id": 0, "name": "url reputation - PhishTank", "action": "8902", "description": "Queries PhishTank for URL's phishing reputation", "type": "url reputation", "app_id": 225, "asset": 3, "parameters": [{"url": ""}]}], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}, {"id": "a947eacc-04e3-485e-bac4-6566e85df173", "create_time": 1764758755.9060266, "update_time": 1788280100.5284767, "name": "Research%20Network%20and%20Traffic%20logs%20", "order": 2, "tag": "7586c74e-6844-45bb-9535-4924752ff0de", "description": "Not%20all%20Dashboards%20may%20come%20into%20play%20depending%20on%20detection/s%20%0A%20%0AFind%20and%20document%20any%20evidence%20linked%20to%20detections.%0A%0ASuggested%20Dashboards%0A1.%20%5BWeb%20Center%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/web_center)%0A2.%20%5BTraffic%20Center%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/traffic_center)%0A3.%20%5BTraffic%20Search%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/traffic_search)%0A4.%20%5BTraffic%20Size%20Analysis%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/traffic_size_analysis)%0A5.%20%5BPort%20and%20Protocol%20Tracker%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/port_protocol_tracker)", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}, {"id": "bfa0b1ad-7bb1-484d-bcfa-16df7989518c", "create_time": 1764758755.906122, "update_time": 1788280100.528601, "name": "Research%20Authentication%20Behavior", "order": 3, "tag": "5f7e4c57-343a-4a5c-8c90-643bdb578dbb", "description": "Not%20all%20Dashboards%20may%20come%20into%20play%20depending%20on%20detection/s%20%0AFind%20and%20document%20any%20evidence%20linked%20to%20detections.%0A%0ASuggested%20Dashboards%0A1.%20%5BRisk%20Analysis%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/risk_analysis)%0A2.%20%5BAccess%20Center%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/access_center)%0A3.%20%5BAccount%20Management%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/account_management)%0A4.%20%5BAccess%20Tracker%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/access_tracker)", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}, {"id": "0168209e-eb24-4a5a-b72a-7c074a96a19c", "create_time": 1764758755.906265, "update_time": 1788280100.5287104, "name": "Research%20OS%20%20and%20Endpoint%20Logs", "order": 4, "tag": "357d8065-7af2-4968-a52e-1daba8d36bcb", "description": "Not%20all%20Dashboards%20may%20come%20into%20play%20depending%20on%20detection/s%20%0AFind%20and%20document%20any%20evidence%20linked%20to%20detections.%0A%0ASuggested%20Dashboards%0A1.%20%5BEndpoint%20Changes%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/endpoint_changes)%0A2.%20%5BMalware%20Center%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/malware_center)%0A3.%20%5BMalware%20Search%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/malware_search)", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}, {"id": "a16d098a-10a7-4b53-a798-fd83c467ddb6", "create_time": 1764758755.9069023, "update_time": 1788280100.528816, "name": "Determine%20full%20impact", "order": 5, "tag": "2419ca1b-fa9e-4443-8334-4642877218c4", "description": "Determine%20and%20Document%20Initial%20Infection%20vectors,%20attack%20targets,%20attacker%20sources,%20infected%20devices,%20compromised%20users.", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}]}, {"id": "1cfc9549-b74f-4dfd-b1c5-956b1587e546", "create_time": 1788276680.0043044, "update_time": 1788280100.530551, "name": "Containment", "order": 3, "tasks": [{"id": "91691144-6812-44e7-ae84-769b7c91778f", "create_time": 1764758755.9071276, "update_time": 1788280100.5289705, "name": "Alert%20Appropriate%20Parties%20of%20evidence%20found%20and%20recommended%20next%20actions", "order": 1, "tag": "fa5fbdd4-4224-460f-80b1-081083c3a8e5", "description": "Send%20Email%20or%20Instant%20message%20to%20appropriate%20teams%20for%20awareness%20and%20assistance%0A%0A%0ASuggested%20Integration%20(if%20not%20already%20configured%20navigate%20%5BHERE%5D(/app/SplunkEnterpriseSecuritySuite/ess_configuration/#/soar/soar_apps/apps)%20to%20locate%20and%20configure)%0A%0A-%20Smtp%20%0A-%20MS%20Graph%20for%20Office%20365%20%0A-%20G%20Suite%20for%20Gmail%20%0A-%20Cisco%20Webex%20%0A-%20Slack%20%0A-%20Microsoft%20Teams", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [{"id": "79483e20-2181-4940-8225-94c2d222e631", "create_time": 1788278442.8867176, "update_time": 1788280100.5290368, "last_job_id": 0, "name": "send email - SMTP", "action": "1903", "description": "Sends an email", "type": "send email", "app_id": 139, "asset": 6, "parameters": [{"cc": "", "to": "", "bcc": "", "body": "", "from": "", "headers": "", "subject": "", "attachments": ""}]}, {"id": "29954e34-f374-48b8-ac1d-ed2d53750ff5", "create_time": 1788278442.886742, "update_time": 1788280100.5290687, "last_job_id": 0, "name": "send email - MS Graph for Office 365", "action": "2339", "description": "Sends an email with optional text rendering. Attachments are allowed a Content-ID tag for reference within the html", "type": "send email", "app_id": 97, "asset": 32, "parameters": [{"cc": "", "to": "", "bcc": "", "body": "", "from": "", "headers": "", "subject": "", "attachments": ""}]}, {"id": "5acb959b-9bf7-4213-9ca4-0237a9191d61", "create_time": 1788278442.8867648, "update_time": 1788280100.5290997, "last_job_id": 0, "name": "send email - G Suite for GMail", "action": "2952", "description": "Send email via Gmail.\n\nConstructs MIME message with attachments, respecting 25MB size limit.\nOptionally creates send-as alias before sending.", "type": "send email", "app_id": 88, "asset": 35, "parameters": [{"cc": "", "to": "", "bcc": "", "body": "", "from": "", "headers": "", "subject": "", "reply_to": "", "alias_name": "", "alias_email": "", "attachments": ""}]}, {"id": "f0239d21-9be0-4768-9971-cb03a109fb8c", "create_time": 1788278442.8867874, "update_time": 1788280100.5291348, "last_job_id": 0, "name": "send message - Cisco Webex", "action": "2960", "description": "Send message to user or room", "type": "send message", "app_id": 42, "asset": 36, "parameters": [{"card": "", "message": "", "vault_id": "", "endpoint_id": "", "is_markdown": false, "destination_type": ""}]}, {"id": "2a6dc7f4-2326-4ca4-b9c3-e824c14e735e", "create_time": 1788278442.8868096, "update_time": 1788280100.529166, "last_job_id": 0, "name": "send message - Slack", "action": "2498", "description": "Send a message to Slack", "type": "send message", "app_id": 152, "asset": 17, "parameters": [{"blocks": "", "message": "", "link_names": false, "destination": "", "reply_broadcast": false, "parent_message_ts": ""}]}, {"id": "ac4ad54a-6826-4758-bd4b-7ea9366d1811", "create_time": 1788278442.8868325, "update_time": 1788280100.5291967, "last_job_id": 0, "name": "send chat message - Microsoft Teams", "action": "2979", "description": "Send a message to specific chat", "type": "send chat message", "app_id": 125, "asset": 37, "parameters": [{"chat_id": "", "message": ""}]}], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}, {"id": "884da2c4-4fb8-494f-bd5a-2c0eacb81646", "create_time": 1764758755.9072351, "update_time": 1788280100.5292842, "name": "Block%20Malicious%20URL%20and%20%20IPs", "order": 2, "tag": "f735a650-8d7e-42ee-95fa-ca8122e29df4", "description": "Using%20the%20information%20documented%20in%20evidence%20if%20applies%20block%20any%20malicious%20or%20compromised%20URLs%20or%20IPs%0A%0ASuggested%20Integration%20(%20if%20not%20already%20configured%20navigate%20%5BHERE%5D(/app/SplunkEnterpriseSecuritySuite/ess_configuration/#/soar/soar_apps/apps)%20to%20locate%20and%20configure)%0A1.%20Cisco%20Firepower%20%0A2.%20Cisco%20Secure%20Firewall%20%0A3.%20Palo%20Alto%20%0A4.%20Zscaler%20%0A5.%20VMware%20Carbon%20Black%20Cloud%20for%20Splunk%20SOAR", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [{"id": "8e293ed1-ff03-4401-a9a3-39e7b7eb2d8a", "create_time": 1788278624.1030524, "update_time": 1788280100.5293477, "last_job_id": 0, "name": "block ip - Cisco Firepower", "action": "2989", "description": "Blocks an IP network", "type": "block ip", "app_id": 35, "asset": 38, "parameters": [{"ip": ""}]}, {"id": "0a955b4b-e637-429c-ac6f-b8baed5cc5c9", "create_time": 1788278624.1030767, "update_time": 1788280100.5293787, "last_job_id": 0, "name": "delete network object - Cisco Secure Firewall", "action": "2995", "description": "Deletes a network object in FMC", "type": "delete network object", "app_id": 37, "asset": 39, "parameters": [{"type": "", "object_id": "", "domain_name": ""}]}, {"id": "805b7d47-1625-4a45-abe3-d187d94fbdae", "create_time": 1788278624.1030996, "update_time": 1788280100.5294104, "last_job_id": 0, "name": "block ip - Panorama", "action": "2395", "description": "Block an IP", "type": "block ip", "app_id": 119, "asset": 10, "parameters": [{"ip": "", "policy_name": "", "policy_type": "", "device_group": "", "audit_comment": "", "should_add_tag": false, "is_source_address": false, "use_partial_commit": false, "should_commit_changes": false}]}, {"id": "984a01e3-f98b-4500-8e1e-1308536615c3", "create_time": 1788278624.1031215, "update_time": 1788280100.5294404, "last_job_id": 0, "name": "block url - Panorama", "action": "2391", "description": "Block an URL", "type": "block url", "app_id": 119, "asset": 10, "parameters": [{"url": "", "policy_name": "", "policy_type": "", "device_group": "", "audit_comment": "", "use_partial_commit": false, "should_commit_changes": false}]}, {"id": "939506af-4344-4903-8716-2c98620b1108", "create_time": 1788278624.1031427, "update_time": 1788280100.529471, "last_job_id": 0, "name": "block ip - Zscaler", "action": "2798", "description": "Block an IP", "type": "block ip", "app_id": 183, "asset": 24, "parameters": [{"ip": "", "url_category": ""}]}, {"id": "7d44cabe-dc7f-4282-9c65-982acc17af71", "create_time": 1788278624.1031644, "update_time": 1788280100.5295005, "last_job_id": 0, "name": "block url - Zscaler", "action": "2799", "description": "Block a URL", "type": "block url", "app_id": 183, "asset": 24, "parameters": [{"url": "", "url_category": ""}]}, {"id": "4972f488-4a2a-43b3-9380-67eaf963f2a3", "create_time": 1788278624.1031861, "update_time": 1788280100.5295336, "last_job_id": 0, "name": "unallow ip - Zscaler", "action": "2804", "description": "Remove an IP address from the allowlist", "type": "unallow ip", "app_id": 183, "asset": 24, "parameters": [{"ip": "", "url_category": ""}]}, {"id": "5a94c3aa-4d81-4803-9bb0-c04abf4a66fd", "create_time": 1788278624.1032078, "update_time": 1788280100.5295634, "last_job_id": 0, "name": "unallow url - Zscaler", "action": "2805", "description": "Remove a URL from the allowed list", "type": "unallow url", "app_id": 183, "asset": 24, "parameters": [{"url": "", "url_category": ""}]}], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}, {"id": "5b6fd766-744a-4ada-9612-9934ff090668", "create_time": 1764758755.9073257, "update_time": 1788280100.5296493, "name": "Block%20Applications%20and%20Hashes", "order": 3, "tag": "de5b8d96-bc90-47e5-a707-4b4ce273b2f5", "description": "Using%20the%20information%20documented%20in%20evidence%20if%20applies%20block%20any%20malicious%20or%20compromised%20applications%0A%0ASuggested%20Integration%20(%20if%20not%20already%20configured%20navigate%20%5BHERE%5D(/app/SplunkEnterpriseSecuritySuite/ess_configuration/#/soar/soar_apps/apps)%20to%20locate%20and%20configure)%0A1.%20Palo%20Alto/Panorama%0A2.%20VMware%20Carbon%20Black%20Cloud%20for%20Splunk%20SOAR", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [{"id": "4aeae82c-9dd1-40c2-a202-8c1681107ad0", "create_time": 1788278773.9890056, "update_time": 1788280100.5297146, "last_job_id": 0, "name": "block application - Panorama", "action": "2393", "description": "Block an application", "type": "block application", "app_id": 119, "asset": 10, "parameters": [{"application": "", "policy_name": "", "policy_type": "", "device_group": "", "audit_comment": "", "use_partial_commit": false, "should_commit_changes": false}]}, {"id": "aab34ec2-4c29-454f-a4c6-977593bb4223", "create_time": 1788278773.9890535, "update_time": 1788280100.5297453, "last_job_id": 0, "name": "block hash - Carbon Black Response", "action": "2075", "description": "Add a hash to the Carbon Black Response blacklist", "type": "block hash", "app_id": 28, "asset": 12, "parameters": [{"hash": "", "comment": ""}]}, {"id": "efce157a-05de-44a0-9068-8a89c805cabb", "create_time": 1788278773.9890966, "update_time": 1788280100.5297751, "last_job_id": 0, "name": "terminate process - Carbon Black Response", "action": "2067", "description": "Kill running processes on a machine", "type": "terminate process", "app_id": 28, "asset": 12, "parameters": [{"pid": "", "sensor_id": "", "ip_hostname": ""}]}], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}, {"id": "c21f1448-9c99-4d7b-818e-d803780529ad", "create_time": 1788279259.257031, "update_time": 1788280100.5298517, "name": "Quarantine%20compromised%20devices%20or%20endpoints", "order": 4, "tag": "de175899-36ac-48d6-9ca4-fa1f31c46019", "description": "Using%20the%20information%20documented%20in%20evidence%20if%20applies%20quarantine%20any%20compromised%20devices.%0A%0ASuggested%20Integration%20(%20if%20not%20already%20configured%20navigate%20%5BHERE%5D(/app/SplunkEnterpriseSecuritySuite/ess_configuration/#/soar/soar_apps/apps)%20to%20locate%20and%20configure)%0A1.%20Crowdstrike%0A2.%20Microsoft%20Defender%20for%20Endpoint%0A3.%20VMware%20Carbon%20Black%20Cloud%20for%20Splunk%20SOAR", "owner": "", "is_note_required": true, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [{"id": "306acb45-61e8-4af7-8836-7f5b23e79f13", "create_time": 1788279409.7877266, "update_time": 1788280100.5299373, "last_job_id": 0, "name": "quarantine device - CrowdStrike OAuth API", "action": "2153", "description": "Block the device", "type": "quarantine device", "app_id": 48, "asset": 19, "parameters": [{"hostname": "", "device_id": ""}]}, {"id": "8e3459f3-a1d1-4230-8461-7ef56dc5a843", "create_time": 1788279409.7877512, "update_time": 1788280100.5299702, "last_job_id": 0, "name": "quarantine device - Windows Defender ATP", "action": "2698", "description": "Quarantine the device", "type": "quarantine device", "app_id": 101, "asset": 40, "parameters": [{"type": "", "comment": "", "timeout": "", "device_id": ""}]}, {"id": "889e7a1d-0df0-43d1-81b9-46ab7359ffba", "create_time": 1788279409.7877738, "update_time": 1788280100.5300007, "last_job_id": 0, "name": "quarantine file - Windows Defender ATP", "action": "2702", "description": "Quarantine a file", "type": "quarantine file", "app_id": 101, "asset": 40, "parameters": [{"comment": "", "timeout": "", "device_id": "", "file_hash": ""}]}, {"id": "7b3a2d28-4942-4598-bffc-7c1f4515ec72", "create_time": 1788279409.787797, "update_time": 1788280100.530035, "last_job_id": 0, "name": "restrict app execution - Windows Defender ATP", "action": "2715", "description": "Restrict execution of all applications on the device except a predefined set", "type": "restrict app execution", "app_id": 101, "asset": 40, "parameters": [{"comment": "", "timeout": "", "device_id": ""}]}, {"id": "5a8eb830-4b4a-411c-993c-fc5ac42da7ef", "create_time": 1788279409.7878232, "update_time": 1788280100.5300653, "last_job_id": 0, "name": "quarantine device - Carbon Black Response", "action": "2062", "description": "Quarantine the endpoint", "type": "quarantine device", "app_id": 28, "asset": 12, "parameters": [{"ip_hostname": ""}]}], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}, {"id": "e2eefabb-dd45-4647-a347-b8a66c3bd2ed", "create_time": 1788279702.6294243, "update_time": 1788280100.5301492, "name": "Disable%20any%20compromised%20or%20malicious%20accounts%20or%20tokens", "order": 5, "tag": "8cd82a46-eb24-4bb7-8023-34d779e4c4d2", "description": "Using%20the%20information%20documented%20in%20evidence%20if%20applies%20Disable%20any%20compromised%20or%20malicious%20accounts%20or%20tokens.%0A%0ASuggested%20Integration%20(%20if%20not%20already%20configured%20navigate%20%5BHERE%5D(/app/SplunkEnterpriseSecuritySuite/ess_configuration/#/soar/soar_apps/apps)%20to%20locate%20and%20configure)%0A%0A1.%20MS%20Graph%20For%20Active%20Directory%20%0A2.%20AD%20LDAP%20%0A3.%20Okta%20%0A4.%20AWS%20IAM%20%0A5.%20Azure%20AD%20Graph", "owner": "", "is_note_required": true, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [{"id": "0b3091e6-c58b-495c-bf1e-92fda2468d00", "create_time": 1788279702.6294713, "update_time": 1788280100.5302153, "last_job_id": 0, "name": "disable account - AD LDAP", "action": "1930", "description": "Disables an Active Directory account", "type": "disable account", "app_id": 2, "asset": 28, "parameters": [{"user": "", "use_samaccountname": false}]}, {"id": "cb9c0ef7-748d-43ea-a0a0-1ba7dbe433cc", "create_time": 1788279702.629496, "update_time": 1788280100.5302463, "last_job_id": 0, "name": "reset password - AD LDAP", "action": "1932", "description": "Resets the password of a user, requiring the user to change password at next login", "type": "reset password", "app_id": 2, "asset": 28, "parameters": [{"user": "", "use_samaccountname": false}]}, {"id": "efcd23da-9a95-4a84-927c-5a80668bf16e", "create_time": 1788279702.629519, "update_time": 1788280100.5302763, "last_job_id": 0, "name": "disable user - Azure AD Graph", "action": "2019", "description": "Disable a user", "type": "disable user", "app_id": 14, "asset": 21, "parameters": [{"user_id": ""}]}, {"id": "73978225-62b4-49d4-b779-e38a85469279", "create_time": 1788279702.6295414, "update_time": 1788280100.5303059, "last_job_id": 0, "name": "reset password - Azure AD Graph", "action": "2016", "description": "Reset or set a user's password in an Azure AD environment", "type": "reset password", "app_id": 14, "asset": 21, "parameters": [{"user_id": "", "force_change": false, "temp_password": ""}]}, {"id": "89d063f3-11e3-49c7-957a-b07b8b9fb141", "create_time": 1788279702.629564, "update_time": 1788280100.5303347, "last_job_id": 0, "name": "disable tokens - Azure AD Graph", "action": "2017", "description": "Invalidate all active refresh tokens for a user in an Azure AD environment", "type": "disable tokens", "app_id": 14, "asset": 21, "parameters": [{"user_id": ""}]}, {"id": "0f2fe1cc-260d-4200-b13d-bcf6aa3ec877", "create_time": 1788279702.629587, "update_time": 1788280100.5303638, "last_job_id": 0, "name": "disable user - AWS IAM", "action": "3044", "description": "Disable login profile and access keys of a user", "type": "disable user", "app_id": 6, "asset": 42, "parameters": [{"username": "", "credentials": "", "disable_access_keys": false}]}, {"id": "e3f709da-f0a0-4140-b837-109df13fbb5e", "create_time": 1788279702.629611, "update_time": 1788280100.5303931, "last_job_id": 0, "name": "disable user - Okta", "action": "2367", "description": "Disables the specified user", "type": "disable user", "app_id": 118, "asset": 13, "parameters": [{"id": ""}]}, {"id": "fac660ff-6fa7-4952-8924-46e41746cfd8", "create_time": 1788279702.6296341, "update_time": 1788280100.5304255, "last_job_id": 0, "name": "disable user - MS Graph for Active Directory", "action": "3021", "description": "Disable a user", "type": "disable user", "app_id": 89, "asset": 41, "parameters": [{"user_id": ""}]}, {"id": "7fed8e92-ceb2-44fa-9711-5a23ed3342c2", "create_time": 1788279702.6296563, "update_time": 1788280100.5304606, "last_job_id": 0, "name": "disable tokens - MS Graph for Active Directory", "action": "3019", "description": "Invalidate all active refresh tokens for a user in a Microsoft AD environment", "type": "disable tokens", "app_id": 89, "asset": 41, "parameters": [{"user_id": ""}]}, {"id": "48c0cfa5-084a-447c-9f44-cd67be2c6ddd", "create_time": 1788279702.6296782, "update_time": 1788280100.53049, "last_job_id": 0, "name": "reset password - MS Graph for Active Directory", "action": "3018", "description": "Reset or set a user's password in a Microsoft AD environment", "type": "reset password", "app_id": 89, "asset": 41, "parameters": [{"user_id": "", "force_change": false, "temp_password": ""}]}], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}]}, {"id": "50452b43-98af-43ab-bfb0-1e9f7368b2c9", "create_time": 1788276680.0046902, "update_time": 1788280100.5313852, "name": "Recovery", "order": 4, "tasks": [{"id": "91a74317-f931-4ced-b4aa-6cdf54433221", "create_time": 1764758755.9079046, "update_time": 1788280100.5306091, "name": "Verify%20the%20integrity%20of%20restored%20assets,%20confirm%20normal%20operations%20with%20system%20owners,%20monitor%20for%20signs%20of%20recurrence", "order": 1, "tag": "c3c83a87-0d75-4d0a-b4e7-9fef0d60e5f4", "description": "Define%20who%20owns%20recovery%20execution,%20who%20approves%20restoration,%20and%20what%20systems/users/services%20are%20in%20scope.%20%0AVerify%20the%20integrity%20of%20restored%20assets,%20confirm%20normal%20operations%20with%20system%20owners,%20and%20monitor%20signs%20of%20recurrence.", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}, {"id": "91f6342d-a92b-4157-a124-5e87ab0c9827", "create_time": 1764758755.9080007, "update_time": 1788280100.5307238, "name": "Complete%20incident%20documentation%20and%20lessons%20learned%20before%20closure", "order": 2, "tag": "27d8d5a5-4c1b-470c-b995-c39275b61444", "description": "Root%20Cause%20Analysis.%20%20New%20Detections,%20Visualizations,%20responses%20or%20playbooks%20to%20help%20resolve%20in%20future.%20", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}, {"id": "5840a534-399b-4ac1-b0bc-80927edf8f8b", "create_time": 1764758755.9080942, "update_time": 1788280100.5308282, "name": "Report%20incident%20response%20status", "order": 3, "tag": "085d0c66-3bb9-48c8-9403-0fc21217d77c", "description": "Alert%20appropriate%20parties%20that%20incident%20response%20is%20complete.%0A%0ASuggested%20Integration%20(if%20not%20already%20configured%20navigate%20%5BHERE%5D(/app/SplunkEnterpriseSecuritySuite/ess_configuration/#/soar/soar_apps/apps)%20to%20locate%20and%20configure)%0A%0A-%20Smtp%20%0A-%20MS%20Graph%20for%20Office%20365%20%0A-%20G%20Suite%20for%20Gmail%20%0A-%20Cisco%20Webex%20%0A-%20Slack%20%0A-%20Microsoft%20Teams", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [{"id": "2bcf6e5e-de9b-42bd-b24c-d4cdd423cb13", "create_time": 1788279986.6035137, "update_time": 1788280100.5308995, "last_job_id": 0, "name": "send email - SMTP", "action": "1903", "description": "Sends an email", "type": "send email", "app_id": 139, "asset": 6, "parameters": [{"cc": "", "to": "", "bcc": "", "body": "", "from": "", "headers": "", "subject": "", "attachments": ""}]}, {"id": "393db9ae-69e9-4172-8b08-a7e59cf20aa9", "create_time": 1788279986.6035569, "update_time": 1788280100.5309548, "last_job_id": 0, "name": "send email - MS Graph for Office 365", "action": "2339", "description": "Sends an email with optional text rendering. Attachments are allowed a Content-ID tag for reference within the html", "type": "send email", "app_id": 97, "asset": 32, "parameters": [{"cc": "", "to": "", "bcc": "", "body": "", "from": "", "headers": "", "subject": "", "attachments": ""}]}, {"id": "d80a5892-bc25-4b3a-be22-af3620e30994", "create_time": 1788279986.6036005, "update_time": 1788280100.530988, "last_job_id": 0, "name": "send email - G Suite for GMail", "action": "2952", "description": "Send email via Gmail.\n\nConstructs MIME message with attachments, respecting 25MB size limit.\nOptionally creates send-as alias before sending.", "type": "send email", "app_id": 88, "asset": 35, "parameters": [{"cc": "", "to": "", "bcc": "", "body": "", "from": "", "headers": "", "subject": "", "reply_to": "", "alias_name": "", "alias_email": "", "attachments": ""}]}, {"id": "4d83b65b-55b8-4d55-81a0-1e7ee2e25ade", "create_time": 1788279986.6036437, "update_time": 1788280100.5310204, "last_job_id": 0, "name": "send message - Cisco Webex", "action": "2960", "description": "Send message to user or room", "type": "send message", "app_id": 42, "asset": 36, "parameters": [{"card": "", "message": "", "vault_id": "", "endpoint_id": "", "is_markdown": false, "destination_type": ""}]}, {"id": "db31bdad-1648-4426-bb85-2fed1912d79d", "create_time": 1788279986.6036847, "update_time": 1788280100.5310526, "last_job_id": 0, "name": "send message - Slack", "action": "2498", "description": "Send a message to Slack", "type": "send message", "app_id": 152, "asset": 17, "parameters": [{"blocks": "", "message": "", "link_names": false, "destination": "", "reply_broadcast": false, "parent_message_ts": ""}]}, {"id": "49790c40-0d53-4598-b162-25d69c9ce19b", "create_time": 1788279986.603725, "update_time": 1788280100.5310874, "last_job_id": 0, "name": "send chat message - Microsoft Teams", "action": "2979", "description": "Send a message to specific chat", "type": "send chat message", "app_id": 125, "asset": 37, "parameters": [{"chat_id": "", "message": ""}]}], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}, {"id": "a18d484f-0600-490d-9b4c-52851cd7b767", "create_time": 1788280100.5311828, "update_time": 1788280100.5311832, "name": "Update%20and%20close%20company-wide%20awareness%20tickets%20when%20appropriate.", "order": 4, "tag": "44b218d8-0a50-47f1-a5ed-20a5c73ff522", "description": "Update%20Incident%20to%20track%20notes%20from%20the%20investigaiton.%0A%0ASuggested%20Integration%20(if%20not%20already%20configured%20navigate%20%5BHERE%5D(/app/SplunkEnterpriseSecuritySuite/ess_configuration/#/soar/soar_apps/apps)%20to%20locate%20and%20configure)%0A%0A-%20Service%20Now%20%0A-%20Salesforce%20%0A-%20Jira", "owner": "", "is_note_required": true, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [{"id": "cc88b369-e5e6-4d63-9d88-97d985edd8f8", "create_time": 1788280100.5312567, "update_time": 1788280100.5312572, "last_job_id": 0, "name": "update ticket - ServiceNow", "action": "2473", "description": "Update ticket/record information", "type": "update ticket", "app_id": 147, "asset": 29, "parameters": [{"id": "", "table": "", "fields": "", "vault_id": "", "is_sys_id": false}]}, {"id": "99b0e0e2-2efd-4f9f-b4f4-6e68501acb3a", "create_time": 1788280100.5312977, "update_time": 1788280100.5312986, "last_job_id": 0, "name": "update ticket - Salesforce", "action": "2937", "description": "Update a Case", "type": "update ticket", "app_id": 144, "asset": 34, "parameters": [{"id": "", "status": "", "subject": "", "priority": "", "description": "", "field_values": "", "parent_case_id": ""}]}, {"id": "cc9e1aca-7be7-4b4c-a5ff-7c4929e8dd73", "create_time": 1788280100.531338, "update_time": 1788280100.5313385, "last_job_id": 0, "name": "update ticket - Jira", "action": "2287", "description": "Update ticket (issue)", "type": "update ticket", "app_id": 80, "asset": 31, "parameters": [{"id": "", "vault_id": "", "update_fields": ""}]}], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}]}], "origin": {"id": "67fc1f68-1928-4436-8525-2957aac3a534", "name": "Generic Incident Response", "version": 4}, "template_id": "69f3e851-6e19-4ecd-ae2b-7cd558d49133", "active": true, "used": false, "ai_generated": false, "source_attachment_id": null, "_user": "nobody", "_key": "bd873ed6-1463-4fbf-a184-8cc3ad7c446c"}