iris-web icon indicating copy to clipboard operation
iris-web copied to clipboard

[FR] It would be cool to have case Templates with the possibility to add Playbook

Open pleibling opened this issue 1 year ago • 4 comments

Please ensure your feature request is not already on the roadmap or associated with an issue. This can be checked here.

Templates are asked for, but not for Playbooks.

Is your feature request related to a problem? Please describe. No, but it helped a lot.

Describe the solution you'd like If there are different Templates for Casetypes, so they can have a specific Playbook for different types (e.g. Playbook for Phishing, Playbook for Webshell and so on).

Maybe there are free Playbooks, they can added directly - otherwise or better additional add own Playbooks e.g.:

Playbook for Malware:

  • Isolate Client and start Virusscan
  • Disable Internet
  • Isolate Fileservers and Domain Controllers
  • Start Virusscan of the Servers

pleibling avatar Apr 19 '23 10:04 pleibling

Hi,

Case templates will populate cases with summary, notes, tasks, and tags. I don't really see how playbooks would add additional information. Can you precise?

Ektoplasma avatar Apr 19 '23 11:04 Ektoplasma

Hi @Ektoplasma, thanks for your fast reply. I saw it in the first time in Catalyst SOAR (https://catalyst-soar.com/features - under Tickettemplates and Playbooks) and play a little with them. I create some samples - if i create a case with the type, the shown me directly specific Informations (To Do, Playbooks, Links and so on) dependent to the Type of the created case.

I hope you can understand what i mean.

pleibling avatar Apr 19 '23 11:04 pleibling

Ah I get it! Yeah why not, let's keep that FR open :)

Ektoplasma avatar Apr 19 '23 11:04 Ektoplasma

Thanks @Ektoplasma, sounds good :).

pleibling avatar Apr 19 '23 11:04 pleibling