QuestionQ5
Playbook DevelopmentA playbook loop that queries Active Directory for user details, producing extensive data, is changed to extract newly acquired indicators of compromise (IOCs). This modification creates two critical issues:
- Rate limits are reached on integrated reputation services.
- Incidents are associated with hundreds of indicators.
Given the following settings, what would prevent these issues in this use case?
Incident Type: AD-Analysis -
Extract Indicators on Incident Creation: Use System Default (None)
Extract Indicators on Field Change: Inline
Task 1: ad-get-user -
Mark results as note: False -
Indicator Extract Mode: Inline -
Quiet Mode: False -
Task 2: ad-disable-account -
Mark results as note: True -
Indicator Extract Mode: None -
Quiet Mode: True -
Task 3: servicenow-update-Lickel.
Mark results as note: False -
Indicator Extract Mode: Use System Default
Quiet Mode: False
- A SetAD-Analysis incident creation extraction to "Extract specific indicators."
- B Set ad-get-user indicator extraction mode to None.
- C Set servicenow-update-ticket indicator extraction mode to Inline.
- D Disable the feature that allows marking task outputs as notes.
Community Discussion