Suspicious-address checks with alerts to your team

The scenario checks a suspicious address against several threat databases, makes a summary, and on a real threat opens an incident and alerts your messenger.

  • Checks an address against several threat databases at once
  • Builds a short, clear summary
  • Opens an incident on a real threat
  • Alerts the team only for genuine threats
Webhook
Set it up for meScriptera

How it works

To get hawk notifications in botHelp, you don't need a developer: a ready-made scenario watches events and sends messages for you.

  1. Starts when: Splunk Alert
  2. Then: Extract IOCs
  3. Then: VirusTotal IP reputation check
  4. Check: Merge Threat Data
  5. Then: Process Intel Data
  6. Then: Generate IP Summary
  7. Then: IP summary display
  8. Then: Gmail
  9. Check: Filter Suspicious IPs
  10. If yes: Create IP Incident
  11. If yes: Slack IP Alert
  12. Then: AlienVault Lookup

You can launch this hawk + botHelp integration in Scriptera: describe the task in plain words — the scenario is built, launched and monitored for you.

Similar scenarios