Playbook: Risk Notable Merge Events
Description
This playbook finds related events based on key fields in a risk notable and allows the user to process the results and decide which events to merge into the current investigation.
How To Implement
For detailed implementation see https://help.splunk.com/en/splunk-enterprise-security-8/security-content-update/how-to-use-splunk-security-content/5.8/use-splunk-soar-playbooks-and-workbooks-from-the-risk-notable-playbook-pack/get-started-with-the-risk-notable-playbook-pack-for-splunk-soar
Explore Playbook
Click the playbook screenshot to explore in more detail!
Reference
source | version: 1