Skip to content

phantomcyber/playbooks

BranchesTags
 
 

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

491 Commits
custom_functions
custom_functions
 
 
.gitignore
.gitignore
 
 
README.md
README.md
 
 
activedirectory_reset_password.json
activedirectory_reset_password.json
 
 
activedirectory_reset_password.png
activedirectory_reset_password.png
 
 
activedirectory_reset_password.py
activedirectory_reset_password.py
 
 
advanced_playbook_tutorial.json
advanced_playbook_tutorial.json
 
 
advanced_playbook_tutorial.png
advanced_playbook_tutorial.png
 
 
advanced_playbook_tutorial.py
advanced_playbook_tutorial.py
 
 
alert_deescalation_for_test_machines.json
alert_deescalation_for_test_machines.json
 
 
alert_deescalation_for_test_machines.png
alert_deescalation_for_test_machines.png
 
 
alert_deescalation_for_test_machines.py
alert_deescalation_for_test_machines.py
 
 
alert_escalation_for_attacked_executives.json
alert_escalation_for_attacked_executives.json
 
 
alert_escalation_for_attacked_executives.png
alert_escalation_for_attacked_executives.png
 
 
alert_escalation_for_attacked_executives.py
alert_escalation_for_attacked_executives.py
 
 
aws_disable_user_accounts.json
aws_disable_user_accounts.json
 
 
aws_disable_user_accounts.png
aws_disable_user_accounts.png
 
 
aws_disable_user_accounts.py
aws_disable_user_accounts.py
 
 
aws_find_inactive_users.json
aws_find_inactive_users.json
 
 
aws_find_inactive_users.png
aws_find_inactive_users.png
 
 
aws_find_inactive_users.py
aws_find_inactive_users.py
 
 
azure_new_user_census.json
azure_new_user_census.json
 
 
azure_new_user_census.png
azure_new_user_census.png
 
 
azure_new_user_census.py
azure_new_user_census.py
 
 
block_indicators.json
block_indicators.json
 
 
block_indicators.png
block_indicators.png
 
 
block_indicators.py
block_indicators.py
 
 
botnet_report_monitor.json
botnet_report_monitor.json
 
 
botnet_report_monitor.png
botnet_report_monitor.png
 
 
botnet_report_monitor.py
botnet_report_monitor.py
 
 
c2_investigate_and_contain.json
c2_investigate_and_contain.json
 
 
c2_investigate_and_contain.png
c2_investigate_and_contain.png
 
 
c2_investigate_and_contain.py
c2_investigate_and_contain.py
 
 
compromised_email_containment.json
compromised_email_containment.json
 
 
compromised_email_containment.png
compromised_email_containment.png
 
 
compromised_email_containment.py
compromised_email_containment.py
 
 
corelight_investigate_dns_alert.json
corelight_investigate_dns_alert.json
 
 
corelight_investigate_dns_alert.png
corelight_investigate_dns_alert.png
 
 
corelight_investigate_dns_alert.py
corelight_investigate_dns_alert.py
 
 
crowdstrike_malware_triage.json
crowdstrike_malware_triage.json
 
 
crowdstrike_malware_triage.png
crowdstrike_malware_triage.png
 
 
crowdstrike_malware_triage.py
crowdstrike_malware_triage.py
 
 
customer_firewall_request_handle_artifact.json
customer_firewall_request_handle_artifact.json
 
 
customer_firewall_request_handle_artifact.png
customer_firewall_request_handle_artifact.png
 
 
customer_firewall_request_handle_artifact.py
customer_firewall_request_handle_artifact.py
 
 
customer_firewall_request_parse_csv.json
customer_firewall_request_parse_csv.json
 
 
customer_firewall_request_parse_csv.png
customer_firewall_request_parse_csv.png
 
 
customer_firewall_request_parse_csv.py
customer_firewall_request_parse_csv.py
 
 
delete_detected_files.json
delete_detected_files.json
 
 
delete_detected_files.png
delete_detected_files.png
 
 
delete_detected_files.py
delete_detected_files.py
 
 
dns_hijack_enrichment.json
dns_hijack_enrichment.json
 
 
dns_hijack_enrichment.png
dns_hijack_enrichment.png
 
 
dns_hijack_enrichment.py
dns_hijack_enrichment.py
 
 
ec2_instance_investigation_and_notification.json
ec2_instance_investigation_and_notification.json
 
 
ec2_instance_investigation_and_notification.png
ec2_instance_investigation_and_notification.png
 
 
ec2_instance_investigation_and_notification.py
ec2_instance_investigation_and_notification.py
 
 
ec2_instance_isolation.json
ec2_instance_isolation.json
 
 
ec2_instance_isolation.png
ec2_instance_isolation.png
 
 
ec2_instance_isolation.py
ec2_instance_isolation.py
 
 
email_notification_for_malware.json
email_notification_for_malware.json
 
 
email_notification_for_malware.png
email_notification_for_malware.png
 
 
email_notification_for_malware.py
email_notification_for_malware.py
 
 
endace_splunk_search_download_pcap.json
endace_splunk_search_download_pcap.json
 
 
endace_splunk_search_download_pcap.png
endace_splunk_search_download_pcap.png
 
 
endace_splunk_search_download_pcap.py
endace_splunk_search_download_pcap.py
 
 
excessive_account_lockouts_enrichment_and_response.json
excessive_account_lockouts_enrichment_and_response.json
 
 
excessive_account_lockouts_enrichment_and_response.png
excessive_account_lockouts_enrichment_and_response.png
 
 
excessive_account_lockouts_enrichment_and_response.py
excessive_account_lockouts_enrichment_and_response.py
 
 
extrahop_detect_data_exfiltration.json
extrahop_detect_data_exfiltration.json
 
 
extrahop_detect_data_exfiltration.png
extrahop_detect_data_exfiltration.png
 
 
extrahop_detect_data_exfiltration.py
extrahop_detect_data_exfiltration.py
 
 
extrahop_externally_accessible_databases.json
extrahop_externally_accessible_databases.json
 
 
extrahop_externally_accessible_databases.png
extrahop_externally_accessible_databases.png
 
 
extrahop_externally_accessible_databases.py
extrahop_externally_accessible_databases.py
 
 
extrahop_new_dns_servers.json
extrahop_new_dns_servers.json
 
 
extrahop_new_dns_servers.png
extrahop_new_dns_servers.png
 
 
extrahop_new_dns_servers.py
extrahop_new_dns_servers.py
 
 
gcp_unusual_serviceaccount_usage.json
gcp_unusual_serviceaccount_usage.json
 
 
gcp_unusual_serviceaccount_usage.png
gcp_unusual_serviceaccount_usage.png
 
 
gcp_unusual_serviceaccount_usage.py
gcp_unusual_serviceaccount_usage.py
 
 
gnql_enrichment.json
gnql_enrichment.json
 
 
gnql_enrichment.png
gnql_enrichment.png
 
 
gnql_enrichment.py
gnql_enrichment.py
 
 
greynoise_gnql_enrichment.json
greynoise_gnql_enrichment.json
 
 
greynoise_gnql_enrichment.png
greynoise_gnql_enrichment.png
 
 
greynoise_gnql_enrichment.py
greynoise_gnql_enrichment.py
 
 
greynoise_ip_enrichment.json
greynoise_ip_enrichment.json
 
 
greynoise_ip_enrichment.png
greynoise_ip_enrichment.png
 
 
greynoise_ip_enrichment.py
greynoise_ip_enrichment.py
 
 
greynoise_on_poll_set_severity.json
greynoise_on_poll_set_severity.json
 
 
greynoise_on_poll_set_severity.png
greynoise_on_poll_set_severity.png
 
 
greynoise_on_poll_set_severity.py
greynoise_on_poll_set_severity.py
 
 
greynoise_update_severity_from_ip_reputation.json
greynoise_update_severity_from_ip_reputation.json
 
 
greynoise_update_severity_from_ip_reputation.png
greynoise_update_severity_from_ip_reputation.png
 
 
greynoise_update_severity_from_ip_reputation.py
greynoise_update_severity_from_ip_reputation.py
 
 
hunting.json
hunting.json
 
 
hunting.png
hunting.png
 
 
hunting.py
hunting.py
 
 
investigate.json
investigate.json
 
 

Repository files navigation

Community Playbooks

This is the 4.10 branch of the Phantom Community Playbooks repository, which contains the default initial playbooks and custom functions for each Phantom instance. For older versions of Phantom there are other branches such as 4.9 and 4.8

The Phantom platform automatically links to the branch of this repository that matches the running Phantom version. By default this repository is named community, which can be selected as the Repo filter to only display these playbooks and custom functions. You can update your content with the Update from source control button on the playbook listing page.

About

Phantom Community Playbooks

Resources

Readme

License

Apache-2.0 license
Activity
Custom properties

Stars

456 stars

Watchers

61 watching

Forks

194 forks
Report repository

Releases

No releases published

Packages

No packages published

Contributors 18

+ 4 contributors

Languages