Professional Security Operations Engineer

Question

You are creating a playbook to respond to user phishing reports at your company. You configured a UDM query action to find every user who connected to a malicious domain. You need to extract those users from the UDM query and add them as entities in an alert so that the playbook can reset their passwords. You want to minimize SOC analyst effort. What should you do?

Explanation

The Siemplify Create Entity action can automatically add one or more entities to an alert. Using an Expression Builder placeholder in the Entities Identifier parameter extracts the usernames from the UDM query result at runtime, allowing the downstream password-reset automation to act on them without analyst input. Google Security Operations documents that the Expression Builder extracts data from JSON action results for use in playbook actions, and that entity-creation actions add supplied entity identifiers to an alert.

Learn more

Professional Security Operations Engineer

AstroTutor

Notes

Readiness

QuestionQ31

Community Discussion