| AD4IoT-AutoAlertStatusSync |
IoTOTThreatMonitoringwithDefenderforIoT |
1 |
1 |
| AD4IoT-AutoCloseIncidents |
IoTOTThreatMonitoringwithDefenderforIoT |
1 |
1 |
| AD4IoT-AutoCloseIncidents |
🔗 GitHub Only |
0 |
1 |
| AD4IoT-AutoTriageIncident |
IoTOTThreatMonitoringwithDefenderforIoT |
1 |
1 |
| AD4IoT-CVEAutoWorkflow |
IoTOTThreatMonitoringwithDefenderforIoT |
1 |
1 |
| AD4IoT-MailByProductionLine |
IoTOTThreatMonitoringwithDefenderforIoT |
1 |
1 |
| AD4IoT-MailByProductionLine |
🔗 GitHub Only |
0 |
1 |
| AD4IoT-SendEmailtoIoTOwner |
IoTOTThreatMonitoringwithDefenderforIoT |
1 |
1 |
| ADX-health-playbook |
🔗 GitHub Only |
1 |
2 |
| AS-CrowdstrikeAlerts-Integration |
📄 Standalone |
1 |
1 |
| AS-Datadog-Events-Integration |
📄 Standalone |
1 |
1 |
| AS-Incident-IP-Matched-on-Watchlist |
📄 Standalone |
1 |
1 |
| AS-Recurring-Host-Entity |
📄 Standalone |
1 |
1 |
| CDC_Dismiss_Upstream_Events |
📄 Standalone |
1 |
1 |
| Censys Alert Rescan |
Censys |
1 |
2 |
| Censys Rescan |
Censys |
1 |
1 |
| Check Point EM - Importer (Alerts → Sentinel Incidents) |
Check Point Cyberint Alerts |
1 |
1 |
| CiscoISE-False Positives Clear Policies |
Cisco ISE |
1 |
1 |
| CiscoSDWANReport |
Cisco SD-WAN |
1 |
6 |
| Close-Incident-MCAS |
📄 Standalone |
1 |
1 |
| Close-SentinelIncident-from-ServiceNow |
📄 Standalone |
1 |
1 |
| Comment-OriginAlertURL |
🔗 GitHub Only |
1 |
1 |
| Comment_RemediationSteps |
🔗 GitHub Only |
1 |
1 |
| Comment_RemediationSteps |
🔗 GitHub Only |
1 |
1 |
| ConnectorHealthApp |
🔗 GitHub Only |
1 |
2 |
| Create-AzureSnapshot |
🔗 GitHub Only |
1 |
1 |
| Create-incident-on-missing-Data-Source |
📄 Standalone |
1 |
1 |
| Cyble-ThreatIntelligence-Ingest-Playbook |
Cyble Vision |
1 |
1 |
| Dynamic-Summaries-API-Upsert |
📄 Standalone |
1 |
1 |
| Enrich Dynatrace Application Security Attack with related Microsoft Defender XDR insights |
Dynatrace |
1 |
1 |
| Enrich Dynatrace Application Security Attack with related Microsoft Sentinel Security Alerts |
Dynatrace |
1 |
1 |
| Export-Report-CSV |
🔗 GitHub Only |
0 |
6 |
| Get Sentinel Alerts Evidence - incident trigger |
📄 Standalone |
1 |
1 |
| Get System Info - Palo Alto PAN-OS XML API |
📄 Standalone |
1 |
1 |
| Get Threat PCAP - Palo Alto PAN-OS XML API |
PaloAlto-PAN-OS |
1 |
1 |
| Get Threat PCAP - Palo Alto PAN-OS XML API |
📄 Standalone |
1 |
1 |
| Get-O365Data |
📄 Standalone |
1 |
1 |
| Get-SentinelAlertsEvidence |
📄 Standalone |
1 |
1 |
| Get-SOC-Actions |
SOC-Process-Framework |
1 |
1 |
| Get-SOCActions |
📄 Standalone |
1 |
1 |
| Get-SOCTasks |
📄 Standalone |
1 |
3 |
| GIBTIA_APT_ThreatActor |
Group-IB |
1 |
1 |
| GIBTIA_APT_Threats |
Group-IB |
1 |
1 |
| GIBTIA_Attacks_ddos |
Group-IB |
1 |
1 |
| GIBTIA_Attacks_deface |
Group-IB |
1 |
1 |
| GIBTIA_Attacks_phishing |
Group-IB |
1 |
1 |
| GIBTIA_Attacks_phishing_kit |
Group-IB |
1 |
1 |
| GIBTIA_BP_phishing |
Group-IB |
1 |
1 |
| GIBTIA_BP_phishing_kit |
Group-IB |
1 |
1 |
| GIBTIA_Compromised_account |
Group-IB |
1 |
1 |
| GIBTIA_Compromised_card |
Group-IB |
1 |
1 |
| GIBTIA_Compromised_imei |
Group-IB |
1 |
1 |
| GIBTIA_Compromised_mule |
Group-IB |
1 |
1 |
| GIBTIA_HI_Threat |
Group-IB |
1 |
1 |
| GIBTIA_HI_Threat_Actor |
Group-IB |
1 |
1 |
| GIBTIA_Malware_cnc |
Group-IB |
1 |
1 |
| GIBTIA_Malware_Targeted_Malware |
Group-IB |
1 |
1 |
| GIBTIA_OSI_GitLeak |
Group-IB |
1 |
1 |
| GIBTIA_OSI_PublicLeak |
Group-IB |
1 |
1 |
| GIBTIA_OSI_Vulnerability |
Group-IB |
1 |
1 |
| GIBTIA_Suspicious_ip_open_proxy |
Group-IB |
1 |
1 |
| GIBTIA_Suspicious_ip_socks_proxy |
Group-IB |
1 |
1 |
| GIBTIA_Suspicious_ip_tor_node |
Group-IB |
1 |
1 |
| GreyNoise-IP-CommunityEnrichment |
📄 Standalone |
1 |
2 |
| GreyNoise-IP-Enrichment |
📄 Standalone |
1 |
5 |
| Incident Assignment Shifts |
SentinelSOARessentials |
1 |
1 |
| IncidentUpdate-GetSentinelAlertsEvidence |
📄 Standalone |
1 |
0 |
| Infoblox SOC Import Indicators TI |
Infoblox SOC Insights |
1 |
2 |
| Infoblox-Config-Insights |
Infoblox |
1 |
1 |
| Infoblox-DHCP-Lookup |
Infoblox |
1 |
1 |
| Infoblox-SOC-Import-Indicators-TI |
Infoblox |
1 |
2 |
| Infoblox-TIDE-Lookup |
Infoblox |
1 |
1 |
| Infoblox-TimeRangeBased-DHCP-Lookup |
Infoblox |
1 |
1 |
| Ingestion Cost Alert Playbook |
📄 Standalone |
1 |
0 |
| Log4jIndicatorProcessor |
Apache Log4j Vulnerability Detection |
1 |
1 |
| Move-LogAnalytics-to-Storage |
🔗 GitHub Only |
1 |
2 |
| new-inc-notification |
📄 Standalone |
1 |
1 |
| Notify-ASCAlertAzureResource |
📄 Standalone |
1 |
1 |
| OktaEvents-to-Sentinel |
📄 Standalone |
1 |
1 |
| PaloAltoXDR |
Palo Alto - XDR (Cortex) |
1 |
2 |
| Put Defender for Endpoint Alert as Hunting ARM Template in GitHub Rep |
📄 Standalone |
1 |
1 |
| RecordedFuture-Alert-Importer |
Recorded Future |
1 |
1 |
| Relate alerts to incident by IP |
SentinelSOARessentials |
1 |
1 |
| RFI-Playbook-Alert-Importer-LAW |
Recorded Future Identity |
1 |
1 |
| RFI-search-external-user |
Recorded Future Identity |
1 |
1 |
| RFI-search-workforce-user |
Recorded Future Identity |
1 |
2 |
| Send Ingestion Cost Anomaly Alert |
📄 Standalone |
1 |
1 |
| Send Unhealthy Azure Arc Resource Alert |
📄 Standalone |
1 |
1 |
| Summarize Data for DNS Essentials Solution |
DNS Essentials |
1 |
2 |
| Summarize Data for Network Session Essentials |
Network Session Essentials |
1 |
9 |
| Summarize Web Session Data |
Web Session Essentials |
1 |
4 |
| Sync-Comments-to-M365Defender |
🔗 GitHub Only |
0 |
1 |
| Team Cymru Scout Create Incident And Notify |
Team Cymru Scout |
1 |
7 |
| Team Cymru Scout Enrich Incident |
Team Cymru Scout |
1 |
6 |
| Team Cymru Scout Live Investigation |
Team Cymru Scout |
1 |
1 |
| Tenable VM - Enrich incident with asset info |
Tenable App |
1 |
1 |
| Tenable VM - Enrich incident with vulnerability info |
Tenable App |
1 |
1 |
| Tenable.io - Enrich incident with asset info |
TenableIO |
1 |
1 |
| Tenable.io - Enrich incident with vulnerability info |
TenableIO |
1 |
1 |
| TritonPlayook |
🔗 GitHub Only |
1 |
3 |
| Update-BulkIncidents |
📄 Standalone |
1 |
1 |
| Update-VIPUsers-Watchlist-from-AzureAD-Group |
📄 Standalone |
1 |
2 |
| Vectra Incident Timeline Update |
Vectra XDR |
1 |
1 |
| Vectra Update Incident Based on Tag And Notify |
Vectra XDR |
1 |
1 |
| Watchlist - close incidents with safe IPs |
Watchlists Utilities |
1 |
1 |
| Watchlists - Inform Subscription Owner |
Watchlists Utilities |
1 |
1 |
| workflow |
SAP |
0 |
1 |