Playbooks

1k Total
Completed
Started
Failed
Canceled
4me ITSM Alert
Create a 4me Problem or Request based on a Taegis XDR Alert

Published by
4me ITSM Investigation
Create a 4me Problem or Request based on a Taegis XDR Investigation

Published by
4me ITSM Investigation Sync
Sync 4me Problem or Request with Security Response Investigations

Published by
Activities for Microsoft 365 Defender Alerts
1 Draft
Activities for Microsoft 365 Defender Alerts
AD Change Password At Log On
Change Password At Log On for an AD user using the LDAP(S) Protocol

1 Configuration Published by
AD Deactivate Change Password At Log On
Deactivate Change Password At Log On for an AD user using the LDAP(S) Protocol

1 Configuration Published by
AD Disable User
Disable User account for an AD using the LDAP(S) Protocol

2 Configurations Published by
AD Enable User
Enable User account for an AD using the LDAP(S) Protocol

1 Configuration Published by
AD/LDAP Change Password
Change Password for an AD/LDAP user using the LDAP(S) Protocol

1 Configuration Published by
AD/LDAP Look Up User
Look up an AD/LDAP user using the LDAP(S) Protocol

1 Configuration Published by
Alert Email Notification
Send email notifications for alerts

1 Configuration Published by
Alert Email Notification with Google Gmail
Send email notifications for alerts with Google Gmail API

Published by
Alert ITSM Sync
ServiceNow Alert to ITSM Incident Sync

Published by
Alert SIR Sync
ServiceNow Alert to Security Incident Sync

Published by
Amazon Web Services Disable User Access Keys
Amazon Web Services Disable User Access Keys

Published by
Amazon Web Services Disable User Login
Disable AWS Console login for a specific user

Published by
Amazon Web Services Disable User MFA Devices
Remove MFA Device for a specific AWS user

Published by
Amazon Web Services Enable User Access Keys
Amazon Web Services Enable User Access Keys

Published by
Amazon Web Services Enable User Login
AWS Console create a new login profile with a predefined password for a specific user

Published by
Amazon Web Services Look Up User
Look up an Amazon Web Services User

Published by
Amazon Web Services Update IP Set
Block/unblock an IP address in AWS WAF
Amazon Web Services Update IP Set
Block/unblock an IP address in AWS WAF

3 Configurations
Amazon Web Services Update IP Set
Block/unblock an IP address in AWS WAF

Published by
Automated Action AD Change Password At Log On
Automatically change password at log on for on all users in an alert using using the LDAP(S) Protocol

Published by
Automated Action AD Disable User
Automatically disable all users in an alert using using the LDAP(S) Protocol

Published by
Automated Action Azure AD Disable User
Automatically disable all users in an alert using the Microsoft Graph API

Published by
Automated Action Azure AD Force Password Reset
Automatically force a password reset on all users in an alert using the Microsoft Graph API

Published by
Automated Action Isolate Host Red Cloak
Automated Action Isolate Host Red Cloak

Published by
Automated Action Isolate Host Taegis Agent
Automated Action Isolate Host Taegis Agent

1 Configuration Published by
Azure AD Disable User
Disable Azure AD user account using the Microsoft Graph API

2 Configurations Published by
Azure AD Enable User
Enable Azure AD user account using the Microsoft Graph API

1 Configuration Published by
Azure AD Force Password Reset
Force a password reset on an Azure AD user account using the Microsoft Graph API

1 Configuration Published by
Azure AD Look Up User
Look up an Azure AD user using the Microsoft Graph API

1 Configuration Published by
Azure OpenAI Enrich Investigation
Enrich the key findings of an investigation via Azure OpenAI

Published by
Carbon Black EDR - Block Filehash
Carbon Black EDR (Endpoint Detection and Response) Block Filehash

Published by
Carbon Black EDR - Unblock Filehash
Carbon Black EDR (Endpoint Detection and Response) Unblock Filehash

Published by
CB Cloud - Isolate
VMWare Carbon Black Cloud Isolate

1 Configuration Published by
CB Cloud - Undo Isolate Host
VMWare Carbon Black Cloud Undo Isolate Host

1 Configuration Published by
Change Password At Next Login Google Workspace Admin SDK API
Enable Change Password At Next Login for a user using Google Workspace Admin SDK API

Published by
Change Password Google Workspace Admin SDK API
Change Password of a user using Google Workspace Admin SDK API

Published by
Cisco Meraki Activities
Block and unblock resources in Cisco Meraki

Published by
Comments To Email Notification
Send Taegis Investigation Comments via an Email

Published by
Comments To Mattermost Notification
Send Taegis Investigation Comments To Mattermost

Published by
Comments To Microsoft Teams Notification
Send Taegis Investigation Comments To Microsoft Teams

1 Configuration Published by
Comments To Salesforce Slack Notification
Send Taegis Investigation Comments To Salesforce Slack

Published by
Comments To ServiceNow WorkNote
Send Taegis Investigation Comments To ServiceNow WorkNote

Published by
Cortex XSOAR Alert Incident
Create a Cortex XSOAR Incident based on a Taegis XDR Alert
Cortex XSOAR Investigation Sync
Sync XDR investigations to Cortex XSOAR incidents

Published by
Create Investigations from Alerts
Create XDR Investigations from Alerts

3 Configurations Published by
Create ServiceNow User
Create ServiceNow User

Published by
CrowdStrike Falcon Endpoint - Isolate
CrowdStrike Falcon Endpoint Protection Isolate

2 Configurations Published by
CrowdStrike Falcon Endpoint - Undo Isolate
CrowdStrike Falcon Endpoint Protection Undo Isolate Host

1 Configuration Published by
Deactivate Change Password At Next Login Google Workspace Admin SDK API
Deactivate Change Password At Next Login for a user using Google Workspace Admin SDK API

Published by
Deactivate ServiceNow User
Deactivate ServiceNow User

Published by
DEV - Automated Action Azure AD Force Password Reset
1 Draft
Automatically force a password reset on all users in an alert using the Microsoft Graph API

1 Configuration
DEV - Automated Action Azure AD Revoke User Sessions
1 Draft
Automatically force session revocation on all users in an alert using the Microsoft Graph API

1 Configuration
Dev Automated Action Evaluate SignIns and Respond
Automated respond

1 Configuration
Dev Azure AD Evaluate MFA SignIns
Look up an Azure AD user using the Microsoft Graph API
Dev Azure AD Look Up User
For development of AO custom playbook. Do not use.
Dev Investigation Asset Identification
1 Draft
Identify endpoints/networks associated with an investigation

1 Configuration
Endpoint Tagging
This playbook can be used to add/remove tags to any number of endpoints.

2 Configurations Published by
Endpoint Tagging - Multi
Allow running Endpoint Tagging playbooks multiple times for different criteria

1 Configuration Published by
Entity Response Block Domain
Enables the Block Domain response action

Published by
Entity Response Block File Hash
Enables the Block File Hash response action on file hashes

2 Configurations Published by
Entity Response Block IP
Enables the Block IP response action on IP addresses

1 Configuration Published by
Entity Response Confirm User As Compromised
Confirm User As Compromised

Published by
Entity Response Dismiss User As Compromised
Dismiss User As Compromised

Published by
Entity Response Initiate Antivirus Scan on Asset
Initiate Antivirus Scan on Asset

1 Configuration Published by
Entity Response Isolate Host
Enables the Isolate Host response action on hosts

1 Configuration Published by
Entity Response UnBlock Domain
Enables the UnBlock Domain response action

Published by
Entity Response UnBlock File Hash
Enables the UnBlock File Hash response action on file hashes

1 Configuration Published by
Entity Response UnBlock IP
Enables the UnBlock IP response action on IP addresses

1 Configuration Published by
Entity Response UnIsolate Host
Enables the UnIsolate Host response action on hosts

1 Configuration Published by
EverBridge Alert Incident
Create an EverBridge Incident based on a Taegis XDR Alert

Published by
EverBridge Investigation Incident
Create an EverBridge Incident based on a Taegis XDR Investigation

Published by
Freshdesk Investigation Sync
Sync Taegis investigations with Freshdesk incidents

Published by
Freshservice Alert Ticket
Create a Freshservice Ticket based on a Taegis Alert

Published by
Freshservice Investigation Sync
Sync Taegis investigations with Freshservice tickets

Published by
Freshservice Investigation Ticket
Create a Freshservice Ticket based on a Taegis Investigation

Published by
Generic Webhook
Post all inputs to a webhook URL

Published by
Halo ITSM Investigation Synch
Synch XDR Investigations with Halo ITSM incidents

Published by
Health Event Investigation
Create Taegis Investigations from Health Events

Published by
Investigation CrowdStrikeFalcon Incident Sync
Sync Investigations to CrowdStrikeFalcon Incidents

Published by
Investigation Email Notification
Send email notifications for investigations

Published by
Investigation Email Notification with Google Gmail
Send email notifications for Investigation with Google Gmail API

Published by
Investigation ITSM Sync
ServiceNow Investigation 1-way Sync to ITSM Incidents

Published by
Investigation Service Now MultiTeam Sync
Investigation ServiceNow MultiTeam Sync

Published by
Investigation SIR Sync
ServiceNow Investigation Sync to Security Incident Response

Published by
Investigation SMAX Sync
Taegis Investigation sync to Microfocus SMAX ticket

Published by
Investigations Email Report
Email report about Taegis Investigations

Published by
iSensor Block
Block (shun) a specific IP address on a Secureworks iSensor

1 Configuration Published by
iSensor Firewall Modification
Perform various iSensor firewall related actions

Published by
iSensor Unblock
Unblock (unshun) a specific IP address on a Secureworks iSensor

Published by
Jira Alert Issue
Create an Atlassian Jira Issue based on a Taegis XDR Alert

Published by
Jira Investigation Issue
Create an Atlassian Jira Issue based on a Taegis XDR Investigation

Published by
Jira Investigation Sync
Sync Jira issue with Security Response Investigations

Published by
JupiterOne Investigation AWS Instance Enrichment
Enrich an investigation with AWS instance context from JupiterOne

Published by
Look Up User Google Workspace Admin SDK API
Look up a user using Google Workspace Admin SDK API

Published by
ManageEngine ServiceDesk Plus Alert
Playbook used to create Requests with ManageEngine Service Desk Plus from Taegis XDR Alerts

Published by
ManageEngine ServiceDesk Plus Investigation Sync
Playbook used to sync Investigations with ManageEngine Service Desk Plus Requests

Published by
Mark TenantLabel Information Playbook
1 Draft
Mark Dumps TenantLabel Information
MD ATP - Block Filehash Globally
Microsoft Defender ATP Block Filehash Globally

Published by
MD ATP - Host Response Action
Perform various response actions against a Microsoft Defender host

4 Configurations Published by
MD ATP - Isolate
Microsoft Defender ATP Isolate

Published by
MD ATP - Single Endpoint Filehash Block
Microsoft Defender ATP Block Filehash on a Single Endpoint

Published by
MD ATP - Undo Isolate Host
Microsoft Defender ATP Undo Isolate Host

Published by
MDE - Global Indicator Activities
1 Draft
Microsoft Defender for Endpoint Global Indicator Activities

6 Configurations
Microsoft 365 Defender Alert Status Sync
1 Draft
Sync Microsoft 365 Defender Alert Status with Taegis XDR Alert Status

1 Configuration
Microsoft Identity Protection Activities for Risky User
1 Draft
Update Microsoft Entra user's risk level (Microsoft Identity Protection Risky User) based on the status of a Taegis XDR Alert.
Microsoft Identity Protection Activities for Risky User
1 Draft
Update Microsoft Entra user's risk state (Microsoft Identity Protection Risky User) via Taegis XDR User Entity.

4 Configurations
Microsoft Teams Notification
Send a Microsoft Teams notification via webhook

1 Configuration Published by
Notifications via Google Workspace Chat
Send Taegis notifications to Google Workspace Chat webhook

Published by
OpenAI Enrich Investigation
Enrich the key findings of an investigation via OpenAI

Published by
OPNsense Activities
1 Draft
Block and unblock IP in OPNsense
Opsgenie XDR Alert
Create an Atlassian Opsgenie Alert or Incident based on a Taegis XDR Alert

Published by
Opsgenie XDR Investigation
Create an Atlassian Opsgenie Alert or Incident based on a Taegis XDR Investigation

Published by
PagerDuty Alert Event
Send a PagerDuty Event based on a Taegis XDR Alert

1 Configuration Published by
PagerDuty Investigation Event
Send a PagerDuty Event based on a Taegis XDR Investigation

1 Configuration Published by
PagerDuty Investigation Sync
Sync PagerDuty incidents with Security Response Investigations

Published by
Palo Alto Networks PAN-OS Block/Unblock
Block and unblock IP/CIDR or Domain in Palo Alto Networks PAN-OS

Published by
RC - Isolate
Red Cloak Isolate

1 Configuration Published by
RC - Undo Isolate Host
Red Cloak Undo Isolate Host

Published by
RC Disable Process Disruption
Disable a disrupt process (block filehash) rule in RedCloak

Published by
RC Process Disruption
Disrupt process (block filehash) in RedCloak

1 Configuration Published by
Reactivate User Google Workspace Admin SDK API
Reactivate a user using Google Workspace Admin SDK API

Published by
Salesforce Slack Notification
Send a Salesforce Slack Notification via Webhook

Published by
SCADAfence Platform Investigation Enrichment
Enrich a Taegis Investigation with SCADAfence alert/asset details

Published by
Send Notification Message
Send a notification message to a supported messaging platform

Published by
Sentinel One Threat Mitigation Response Actions
Perform Threat Mitigation response actions against Taegis Alerts

1 Configuration Published by
SentinelOne - Host Response Actions
Perform various response actions against a SentinelOne agent

4 Configurations Published by
ServiceNow Bidirectional Investigation Sync (Inbound)
Update a Taegis Investigation based on data provided by Servicenow

2 Configurations Published by
ServiceNow Bidirectional Investigation Sync (Outbound)
Sync an investigation with Servicenow utilizing Import Sets

2 Configurations Published by
Suspend User Google Workspace Admin SDK API
Suspend a user using Google Workspace Admin SDK API

Published by
Taegis Agent - Isolate
Taegis Agent Isolate

2 Configurations Published by
Taegis Agent - Restore
Taegis Agent Restore from isolation

2 Configurations Published by
Update Investigation with Azure AD User Detail
1 Draft
Update Investigation with Azure AD User Detail

1 Configuration
Update Investigation with Endpoint Summary
Update Investigation with Endpoint Summary

1 Configuration
Update Investigation with IPQualityScore Result
1 Draft
Update Investigation with IPQualityScore Result

1 Configuration
Update Investigation with Network Flow Summary
Update Investigation with Network Flow Summary

1 Configuration Published by
Update Investigation with Retrieved eMail
1 Draft
Update Investigation with Retrieved eMail

1 Configuration
Update Investigation with Taegis VDR Result
1 Draft
Update Investigation with Taegis VDR Result

1 Configuration
Update Investigation with VPNAPI.io Result
1 Draft
Update Investigation with VPNAPI.io Result

1 Configuration
Update Investigation with ZenQuotes
1 Draft
Update Investigation with ZenQuotes

1 Configuration
Update ServiceNow User
Generic ServiceNow user update

Published by
Update Taegis Investigation
Allow for updating an existing Taegis investigation

Published by
xMatters Webhook Alert
Trigger an xMatters event from an Alert via Webhook

Published by
xMatters Webhook Investigation
Trigger an xMatters event from an Investigation via Webhook

Published by
Zendesk Investigation Sync
Sync XDR Investigations with Zendesk incidents

Published by