mirror of
https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git
synced 2026-07-24 13:40:57 +03:00
96 lines
2.0 KiB
Markdown
96 lines
2.0 KiB
Markdown
# Workflows - SOAR Playbook with XSOAR
|
|
|
|
## Playbook Development Lifecycle
|
|
|
|
```
|
|
1. Identify Manual Process
|
|
- Document current analyst workflow
|
|
- Measure time per step
|
|
|
|
|
v
|
|
2. Design Playbook Logic
|
|
- Map decision points
|
|
- Identify automation candidates
|
|
- Define manual review gates
|
|
|
|
|
v
|
|
3. Build in XSOAR
|
|
- Create playbook in visual editor
|
|
- Configure integration commands
|
|
- Add conditional branches
|
|
- Write custom scripts if needed
|
|
|
|
|
v
|
|
4. Test with Sample Data
|
|
- Create test incidents
|
|
- Verify each task executes correctly
|
|
- Test error handling paths
|
|
|
|
|
v
|
|
5. Pilot in Production
|
|
- Run on subset of incidents
|
|
- Compare automated vs manual results
|
|
- Gather analyst feedback
|
|
|
|
|
v
|
|
6. Full Deployment
|
|
- Enable for all matching incidents
|
|
- Monitor playbook performance
|
|
- Track MTTR improvements
|
|
|
|
|
v
|
|
7. Continuous Improvement
|
|
- Review failed tasks monthly
|
|
- Update integrations as needed
|
|
- Add new sub-playbooks
|
|
```
|
|
|
|
## Incident Lifecycle in XSOAR
|
|
|
|
```
|
|
Alert Ingestion (SIEM/EDR/Email)
|
|
|
|
|
v
|
|
Pre-Processing (Classification, Deduplication)
|
|
|
|
|
v
|
|
Incident Created (Type, Severity, Owner assigned)
|
|
|
|
|
v
|
|
Playbook Triggered Automatically
|
|
|
|
|
+-- Enrichment Phase (parallel)
|
|
| |-- IP/Domain/Hash lookup
|
|
| |-- User/Asset lookup
|
|
| |-- TI feed correlation
|
|
|
|
|
+-- Analysis Phase
|
|
| |-- Verdict determination
|
|
| |-- Risk scoring
|
|
|
|
|
+-- Response Phase
|
|
| |-- Containment actions (auto or manual approval)
|
|
| |-- Eradication steps
|
|
| |-- Recovery procedures
|
|
|
|
|
+-- Documentation Phase
|
|
| |-- War room timeline
|
|
| |-- Closing report
|
|
| |-- Ticket update
|
|
|
|
|
v
|
|
Incident Closed
|
|
```
|
|
|
|
## ROI Measurement Workflow
|
|
|
|
```
|
|
Before SOAR:
|
|
Count manual hours per incident type per month
|
|
|
|
After SOAR:
|
|
Measure automated handling time
|
|
Calculate: Saved Hours = Manual Hours - Automated Hours
|
|
Calculate: ROI = (Saved Hours * Analyst Hourly Cost) / SOAR License Cost
|
|
```
|