Shuffle categories
1. Collect & Distribute
2-way Ticket synchronization
Email management
Attachments
Manage senders
Manage URLs
Encode & Decode URLs
Release a quarantined message
EDR to ticket
Fetch incidents & events
Quarantine files
Quarantine host (respond)
Get host information
SIEM to ticket
ChatOps
Threat Intel received
Domain investigation with LetsEncrypt
Botnet tracker
Get running containers
Assign tickets
Firewall alerts
Block/accept policies
Add addresses and ports to groups
Support custom URL categories
Fetch logs for specific address
URL filtering
IDS/IPS alerts
Get/Fetch alerts
Receive alerts real-time
Get PCAP files
Get network logs
Manage policies
Deduplicate information
Correlate information
3. Detect
Search SIEM (Sigma)
Network
Endpoint
Search EDR (OSQuery)
Search emails (Phish)
Check malware
Check targeted
Check headers and IOCs
Search IOCs (ioc-finder)
Search files (Yara)
Correlate tickets
Honeypot access
S3 Honeypot
SSH Honeypot
FTP honeypot
Network honeypot
...
rich
5. Verify
Discover vulnerabilities
Discover assets
Ensure policies are followed
Find Inactive users
Ensure access rights match HR systems
Ensure onboarding is followed
Third party apps in SaaS
Devices used for your cloud account
Too much access in GCP/Azure/AWS/ other clouds
Certificate validation
Monitor new DNS entries for domain with passive DNS
Monitor and track password dumps
Monitor for mentions of domain on darknet sites
Reporting
Automation time saved
Automation money saved
Incident response report
Department cost
Monthly reports
EDR alerts
SIEM alerts
Emails quarantined
...
4. Respond
Eradicate malware
Quarantine host(s)
Trigger scans
Update indicators (FW, EDR, SIEM...)
Autoblock activity when threat intel is received
Lock/Delete/Reset account
Lock vault
Increase authentication
Get policies from assets
2. Enrich
Internal Enrichment
Users
Hostnames
IPs
Departments
Role
Software
...
External historical Enrichment
IPs
URLs
Hashes
Files
...
Realtime
File detonation
URL detonation
PCAP analysis
Analyze screenshots
Ticketing webhook verification