Skip to content

Commit

Permalink
Rename from Phantom to Splunk SOAR.
Browse files Browse the repository at this point in the history
  • Loading branch information
ChuckWoodraska committed Nov 15, 2021
1 parent b88a481 commit 5319af9
Show file tree
Hide file tree
Showing 10 changed files with 3 additions and 4 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@ Retrieve the Domain Risk Score and throw an Alert for the Analyst to manually re

#### Before Installing
In this directory there is a csv called `domaintools_domain_risk.csv` that can be downloaded and used to import into the app under the "Custom Lists" tab on the "Playbooks" feature. With the `domaintoolsiriscreds` asset loaded in, import the csv or create a custom list named `domaintools_domain_risk` and copy the contents of the csv into the custom list.
**The value in the list is the mininmum risk score to alert on, the number can be changed by the analyst, but the first column should not be changed, otherwise the playbook will break.**
**The value in the list is the minimum risk score to alert on, the number can be changed by the analyst, but the first column should not be changed, otherwise the playbook will break.**

#### Installation
Download the tar file in this directory and import the playbook using that file. The asset accessed in the playbook is for DomainTools API credentials. Point the playbook to the `domaintoolsiriscreds` asset, save the playbook, make sure it's active, and give it a shot.
5 changes: 2 additions & 3 deletions Splunk Phantom/README.md → Splunk SOAR/README.md
Original file line number Diff line number Diff line change
@@ -1,11 +1,10 @@
## DomainTools Phantom Playbooks
## DomainTools Splunk SOAR Playbooks

Working playbooks and automation scripts for Splunk Phantom.
Working playbooks and automation scripts for Splunk SOAR.

#### Installation
For the DomainTools playbooks in this repo, an asset called `domaintoolsiriscreds` is needed with
DomainTools API username and key. The playbooks expect this asset to exist to make the API calls needed for the playbook data upon execution. Installation instructions for each playbook is in the README at the root of the playbook’s directory.
<br>

#### Current Playbooks In This Repo

Expand Down

0 comments on commit 5319af9

Please sign in to comment.